diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 70a40303..66efdaec 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -80868,9 +80868,9 @@ discovery: default: "/tmp/T1082.txt" executor: command: "uname -a >> #{output_file}\nif [ -f /etc/lsb-release ]; then cat - /etc/lsb-release >> #{output_file}; fi;\nif [ -f /etc/redhat-release ]; - then cat /etc/redhat-release >> #{output_file}; fi; \nif [ -f /etc/issue - ]; then cat /etc/issue >> #{output_file}; fi;\nuptime >> #{output_file}\ncat + /etc/lsb-release >> #{output_file}; fi\nif [ -f /etc/redhat-release ]; then + cat /etc/redhat-release >> #{output_file}; fi \nif [ -f /etc/issue ]; + then cat /etc/issue >> #{output_file}; fi\nuptime >> #{output_file}\ncat #{output_file} 2>/dev/null\n" cleanup_command: 'rm #{output_file} 2>/dev/null @@ -80886,14 +80886,14 @@ discovery: - linux executor: command: | - if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi; - if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi; - if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi; - if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi; - if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi; - if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi; - if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi; - if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi; + if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi + if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi + if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi + if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi + if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi + if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi + if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi + if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi name: bash - name: Linux VM Check via Kernel Modules auto_generated_guid: 8057d484-0fae-49a4-8302-4812c4f1e64e diff --git a/atomics/T1082/T1082.md b/atomics/T1082/T1082.md index 459e96cb..bc12e2bb 100644 --- a/atomics/T1082/T1082.md +++ b/atomics/T1082/T1082.md @@ -138,9 +138,9 @@ Identify System Info ```sh uname -a >> #{output_file} -if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi; -if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi; -if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi; +if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi +if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi +if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi uptime >> #{output_file} cat #{output_file} 2>/dev/null ``` @@ -174,14 +174,14 @@ Identify virtual machine hardware. This technique is used by the Pupy RAT and ot ```bash -if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi; -if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi; -if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi; -if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi; -if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi; -if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi; -if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi; -if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi; +if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi +if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi +if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi +if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi +if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi +if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi +if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi +if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi ```