Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1602,6 +1602,7 @@ discovery,T1615,Group Policy Discovery,2,Get-DomainGPO to display group policy i
|
||||
discovery,T1615,Group Policy Discovery,3,WinPwn - GPOAudit,bc25c04b-841e-4965-855f-d1f645d7ab73,powershell
|
||||
discovery,T1615,Group Policy Discovery,4,WinPwn - GPORemoteAccessPolicy,7230d01a-0a72-4bd5-9d7f-c6d472bc6a59,powershell
|
||||
discovery,T1615,Group Policy Discovery,5,MSFT Get-GPO Cmdlet,52778a8f-a10b-41a4-9eae-52ddb74072bf,powershell
|
||||
discovery,T1652,Device Driver Discovery,1,Device Driver Discovery,235b30a2-e5b1-441f-9705-be6231c88ddd,powershell
|
||||
discovery,T1087.002,Account Discovery: Domain Account,1,Enumerate all accounts (Domain),6fbc9e68-5ad7-444a-bd11-8bf3136c477e,command_prompt
|
||||
discovery,T1087.002,Account Discovery: Domain Account,2,Enumerate all accounts via PowerShell (Domain),8b8a6449-be98-4f42-afd2-dedddc7453b2,powershell
|
||||
discovery,T1087.002,Account Discovery: Domain Account,3,Enumerate logged on users via CMD (Domain),161dcd85-d014-4f5e-900c-d3eaae82a0f7,command_prompt
|
||||
@@ -1717,12 +1718,11 @@ discovery,T1082,System Information Discovery,24,Azure Security Scan with SkyArk,
|
||||
discovery,T1082,System Information Discovery,25,Linux List Kernel Modules,034fe21c-3186-49dd-8d5d-128b35f181c7,sh
|
||||
discovery,T1082,System Information Discovery,26,FreeBSD List Kernel Modules,4947897f-643a-4b75-b3f5-bed6885749f6,sh
|
||||
discovery,T1082,System Information Discovery,27,System Information Discovery with WMIC,8851b73a-3624-4bf7-8704-aa312411565c,command_prompt
|
||||
discovery,T1082,System Information Discovery,28,Driver Enumeration using DriverQuery,bd85e3d1-4aeb-4a1d-850f-7be3cb8d60b9,command_prompt
|
||||
discovery,T1082,System Information Discovery,29,System Information Discovery,4060ee98-01ae-4c8e-8aad-af8300519cc7,command_prompt
|
||||
discovery,T1082,System Information Discovery,30,Check computer location,96be6002-9200-47db-94cb-c3e27de1cb36,command_prompt
|
||||
discovery,T1082,System Information Discovery,31,BIOS Information Discovery through Registry,f2f91612-d904-49d7-87c2-6c165d23bead,command_prompt
|
||||
discovery,T1082,System Information Discovery,32,ESXi - VM Discovery using ESXCLI,2040405c-eea6-4c1c-aef3-c2acc430fac9,command_prompt
|
||||
discovery,T1082,System Information Discovery,33,ESXi - Darkside system information discovery,f89812e5-67d1-4f49-86fa-cbc6609ea86a,command_prompt
|
||||
discovery,T1082,System Information Discovery,28,System Information Discovery,4060ee98-01ae-4c8e-8aad-af8300519cc7,command_prompt
|
||||
discovery,T1082,System Information Discovery,29,Check computer location,96be6002-9200-47db-94cb-c3e27de1cb36,command_prompt
|
||||
discovery,T1082,System Information Discovery,30,BIOS Information Discovery through Registry,f2f91612-d904-49d7-87c2-6c165d23bead,command_prompt
|
||||
discovery,T1082,System Information Discovery,31,ESXi - VM Discovery using ESXCLI,2040405c-eea6-4c1c-aef3-c2acc430fac9,command_prompt
|
||||
discovery,T1082,System Information Discovery,32,ESXi - Darkside system information discovery,f89812e5-67d1-4f49-86fa-cbc6609ea86a,command_prompt
|
||||
discovery,T1016.002,System Network Configuration Discovery: Wi-Fi Discovery,1,Enumerate Stored Wi-Fi Profiles And Passwords via netsh,53cf1903-0fa7-4177-ab14-f358ae809eec,command_prompt
|
||||
discovery,T1010,Application Window Discovery,1,List Process Main Windows - C# .NET,fe94a1c3-3e22-4dc9-9fdf-3a8bdbc10dc4,command_prompt
|
||||
discovery,T1580,Cloud Infrastructure Discovery,1,AWS - EC2 Enumeration from Cloud Instance,99ee161b-dcb1-4276-8ecb-7cfdcb207820,sh
|
||||
|
||||
|
@@ -351,8 +351,8 @@ discovery,T1082,System Information Discovery,8,Hostname Discovery,486e88ea-4f56-
|
||||
discovery,T1082,System Information Discovery,12,"Environment variables discovery on freebsd, macos and linux",fcbdd43f-f4ad-42d5-98f3-0218097e2720,sh
|
||||
discovery,T1082,System Information Discovery,25,Linux List Kernel Modules,034fe21c-3186-49dd-8d5d-128b35f181c7,sh
|
||||
discovery,T1082,System Information Discovery,26,FreeBSD List Kernel Modules,4947897f-643a-4b75-b3f5-bed6885749f6,sh
|
||||
discovery,T1082,System Information Discovery,32,ESXi - VM Discovery using ESXCLI,2040405c-eea6-4c1c-aef3-c2acc430fac9,command_prompt
|
||||
discovery,T1082,System Information Discovery,33,ESXi - Darkside system information discovery,f89812e5-67d1-4f49-86fa-cbc6609ea86a,command_prompt
|
||||
discovery,T1082,System Information Discovery,31,ESXi - VM Discovery using ESXCLI,2040405c-eea6-4c1c-aef3-c2acc430fac9,command_prompt
|
||||
discovery,T1082,System Information Discovery,32,ESXi - Darkside system information discovery,f89812e5-67d1-4f49-86fa-cbc6609ea86a,command_prompt
|
||||
discovery,T1217,Browser Bookmark Discovery,1,List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux,3a41f169-a5ab-407f-9269-abafdb5da6c2,sh
|
||||
discovery,T1217,Browser Bookmark Discovery,4,List Google Chromium Bookmark JSON Files on FreeBSD,88ca025b-3040-44eb-9168-bd8af22b82fa,sh
|
||||
discovery,T1016,System Network Configuration Discovery,3,System Network Configuration Discovery,c141bbdb-7fca-4254-9fd6-f47e79447e17,sh
|
||||
|
||||
|
@@ -1065,6 +1065,7 @@ discovery,T1615,Group Policy Discovery,2,Get-DomainGPO to display group policy i
|
||||
discovery,T1615,Group Policy Discovery,3,WinPwn - GPOAudit,bc25c04b-841e-4965-855f-d1f645d7ab73,powershell
|
||||
discovery,T1615,Group Policy Discovery,4,WinPwn - GPORemoteAccessPolicy,7230d01a-0a72-4bd5-9d7f-c6d472bc6a59,powershell
|
||||
discovery,T1615,Group Policy Discovery,5,MSFT Get-GPO Cmdlet,52778a8f-a10b-41a4-9eae-52ddb74072bf,powershell
|
||||
discovery,T1652,Device Driver Discovery,1,Device Driver Discovery,235b30a2-e5b1-441f-9705-be6231c88ddd,powershell
|
||||
discovery,T1087.002,Account Discovery: Domain Account,1,Enumerate all accounts (Domain),6fbc9e68-5ad7-444a-bd11-8bf3136c477e,command_prompt
|
||||
discovery,T1087.002,Account Discovery: Domain Account,2,Enumerate all accounts via PowerShell (Domain),8b8a6449-be98-4f42-afd2-dedddc7453b2,powershell
|
||||
discovery,T1087.002,Account Discovery: Domain Account,3,Enumerate logged on users via CMD (Domain),161dcd85-d014-4f5e-900c-d3eaae82a0f7,command_prompt
|
||||
@@ -1141,10 +1142,9 @@ discovery,T1082,System Information Discovery,21,WinPwn - PowerSharpPack - Watson
|
||||
discovery,T1082,System Information Discovery,22,WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors,efb79454-1101-4224-a4d0-30c9c8b29ffc,powershell
|
||||
discovery,T1082,System Information Discovery,23,WinPwn - PowerSharpPack - Seatbelt,5c16ceb4-ba3a-43d7-b848-a13c1f216d95,powershell
|
||||
discovery,T1082,System Information Discovery,27,System Information Discovery with WMIC,8851b73a-3624-4bf7-8704-aa312411565c,command_prompt
|
||||
discovery,T1082,System Information Discovery,28,Driver Enumeration using DriverQuery,bd85e3d1-4aeb-4a1d-850f-7be3cb8d60b9,command_prompt
|
||||
discovery,T1082,System Information Discovery,29,System Information Discovery,4060ee98-01ae-4c8e-8aad-af8300519cc7,command_prompt
|
||||
discovery,T1082,System Information Discovery,30,Check computer location,96be6002-9200-47db-94cb-c3e27de1cb36,command_prompt
|
||||
discovery,T1082,System Information Discovery,31,BIOS Information Discovery through Registry,f2f91612-d904-49d7-87c2-6c165d23bead,command_prompt
|
||||
discovery,T1082,System Information Discovery,28,System Information Discovery,4060ee98-01ae-4c8e-8aad-af8300519cc7,command_prompt
|
||||
discovery,T1082,System Information Discovery,29,Check computer location,96be6002-9200-47db-94cb-c3e27de1cb36,command_prompt
|
||||
discovery,T1082,System Information Discovery,30,BIOS Information Discovery through Registry,f2f91612-d904-49d7-87c2-6c165d23bead,command_prompt
|
||||
discovery,T1016.002,System Network Configuration Discovery: Wi-Fi Discovery,1,Enumerate Stored Wi-Fi Profiles And Passwords via netsh,53cf1903-0fa7-4177-ab14-f358ae809eec,command_prompt
|
||||
discovery,T1010,Application Window Discovery,1,List Process Main Windows - C# .NET,fe94a1c3-3e22-4dc9-9fdf-3a8bdbc10dc4,command_prompt
|
||||
discovery,T1217,Browser Bookmark Discovery,5,List Google Chrome / Opera Bookmarks on Windows with powershell,faab755e-4299-48ec-8202-fc7885eb6545,powershell
|
||||
|
||||
|
@@ -2251,7 +2251,8 @@
|
||||
- Atomic Test #3: WinPwn - GPOAudit [windows]
|
||||
- Atomic Test #4: WinPwn - GPORemoteAccessPolicy [windows]
|
||||
- Atomic Test #5: MSFT Get-GPO Cmdlet [windows]
|
||||
- T1652 Device Driver Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1652 Device Driver Discovery](../../T1652/T1652.md)
|
||||
- Atomic Test #1: Device Driver Discovery [windows]
|
||||
- [T1087.002 Account Discovery: Domain Account](../../T1087.002/T1087.002.md)
|
||||
- Atomic Test #1: Enumerate all accounts (Domain) [windows]
|
||||
- Atomic Test #2: Enumerate all accounts via PowerShell (Domain) [windows]
|
||||
@@ -2376,12 +2377,11 @@
|
||||
- Atomic Test #25: Linux List Kernel Modules [linux]
|
||||
- Atomic Test #26: FreeBSD List Kernel Modules [linux]
|
||||
- Atomic Test #27: System Information Discovery with WMIC [windows]
|
||||
- Atomic Test #28: Driver Enumeration using DriverQuery [windows]
|
||||
- Atomic Test #29: System Information Discovery [windows]
|
||||
- Atomic Test #30: Check computer location [windows]
|
||||
- Atomic Test #31: BIOS Information Discovery through Registry [windows]
|
||||
- Atomic Test #32: ESXi - VM Discovery using ESXCLI [linux]
|
||||
- Atomic Test #33: ESXi - Darkside system information discovery [linux]
|
||||
- Atomic Test #28: System Information Discovery [windows]
|
||||
- Atomic Test #29: Check computer location [windows]
|
||||
- Atomic Test #30: BIOS Information Discovery through Registry [windows]
|
||||
- Atomic Test #31: ESXi - VM Discovery using ESXCLI [linux]
|
||||
- Atomic Test #32: ESXi - Darkside system information discovery [linux]
|
||||
- [T1016.002 System Network Configuration Discovery: Wi-Fi Discovery](../../T1016.002/T1016.002.md)
|
||||
- Atomic Test #1: Enumerate Stored Wi-Fi Profiles And Passwords via netsh [windows]
|
||||
- [T1010 Application Window Discovery](../../T1010/T1010.md)
|
||||
|
||||
@@ -654,8 +654,8 @@
|
||||
- Atomic Test #12: Environment variables discovery on freebsd, macos and linux [linux, macos]
|
||||
- Atomic Test #25: Linux List Kernel Modules [linux]
|
||||
- Atomic Test #26: FreeBSD List Kernel Modules [linux]
|
||||
- Atomic Test #32: ESXi - VM Discovery using ESXCLI [linux]
|
||||
- Atomic Test #33: ESXi - Darkside system information discovery [linux]
|
||||
- Atomic Test #31: ESXi - VM Discovery using ESXCLI [linux]
|
||||
- Atomic Test #32: ESXi - Darkside system information discovery [linux]
|
||||
- T1016.002 System Network Configuration Discovery: Wi-Fi Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1010 Application Window Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1497.003 Time Based Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
|
||||
@@ -1563,7 +1563,8 @@
|
||||
- Atomic Test #3: WinPwn - GPOAudit [windows]
|
||||
- Atomic Test #4: WinPwn - GPORemoteAccessPolicy [windows]
|
||||
- Atomic Test #5: MSFT Get-GPO Cmdlet [windows]
|
||||
- T1652 Device Driver Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1652 Device Driver Discovery](../../T1652/T1652.md)
|
||||
- Atomic Test #1: Device Driver Discovery [windows]
|
||||
- [T1087.002 Account Discovery: Domain Account](../../T1087.002/T1087.002.md)
|
||||
- Atomic Test #1: Enumerate all accounts (Domain) [windows]
|
||||
- Atomic Test #2: Enumerate all accounts via PowerShell (Domain) [windows]
|
||||
@@ -1649,10 +1650,9 @@
|
||||
- Atomic Test #22: WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors [windows]
|
||||
- Atomic Test #23: WinPwn - PowerSharpPack - Seatbelt [windows]
|
||||
- Atomic Test #27: System Information Discovery with WMIC [windows]
|
||||
- Atomic Test #28: Driver Enumeration using DriverQuery [windows]
|
||||
- Atomic Test #29: System Information Discovery [windows]
|
||||
- Atomic Test #30: Check computer location [windows]
|
||||
- Atomic Test #31: BIOS Information Discovery through Registry [windows]
|
||||
- Atomic Test #28: System Information Discovery [windows]
|
||||
- Atomic Test #29: Check computer location [windows]
|
||||
- Atomic Test #30: BIOS Information Discovery through Registry [windows]
|
||||
- [T1016.002 System Network Configuration Discovery: Wi-Fi Discovery](../../T1016.002/T1016.002.md)
|
||||
- Atomic Test #1: Enumerate Stored Wi-Fi Profiles And Passwords via netsh [windows]
|
||||
- [T1010 Application Window Discovery](../../T1010/T1010.md)
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
| [Phishing: Spearphishing Attachment](../../T1566.001/T1566.001.md) | [Command and Scripting Interpreter: JavaScript](../../T1059.007/T1059.007.md) | [Modify Authentication Process: Pluggable Authentication Modules](../../T1556.003/T1556.003.md) | Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Signed Binary Proxy Execution: Rundll32](../../T1218.011/T1218.011.md) | [Brute Force: Password Guessing](../../T1110.001/T1110.001.md) | Permission Groups Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Replication Through Removable Media](../../T1091/T1091.md) | [Input Capture: Keylogging](../../T1056.001/T1056.001.md) | Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Application Layer Protocol: DNS](../../T1071.004/T1071.004.md) | OS Exhaustion Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Compromise Hardware Supply Chain [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Kubernetes Cronjob](../../T1053.007/T1053.007.md) | Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | Embedded Payloads [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping](../../T1003/T1003.md) | Cloud Groups [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Direct Cloud VM Connections [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Data from Configuration Repository [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration Over Bluetooth [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Symmetric Cryptography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Application Exhaustion Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Replication Through Removable Media](../../T1091/T1091.md) | [Inter-Process Communication: Dynamic Data Exchange](../../T1559.002/T1559.002.md) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Modify Authentication Process: Pluggable Authentication Modules](../../T1556.003/T1556.003.md) | [Steal Web Session Cookie](../../T1539/T1539.md) | [Group Policy Discovery](../../T1615/T1615.md) | SSH Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Sharepoint [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Automated Exfiltration](../../T1020/T1020.md) | Fast Flux DNS [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Disk Wipe [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Supply Chain Compromise](../../T1195/T1195.md) | [User Execution: Malicious File](../../T1204.002/T1204.002.md) | Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Revert Cloud Instance [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping: Security Account Manager](../../T1003.002/T1003.002.md) | Device Driver Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Remote Services: SMB/Windows Admin Shares](../../T1021.002/T1021.002.md) | [Audio Capture](../../T1123/T1123.md) | Exfiltration Over Symmetric Encrypted Non-C2 Protocol [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Application Layer Protocol](../../T1071/T1071.md) | Stored Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Supply Chain Compromise](../../T1195/T1195.md) | [User Execution: Malicious File](../../T1204.002/T1204.002.md) | Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Revert Cloud Instance [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping: Security Account Manager](../../T1003.002/T1003.002.md) | [Device Driver Discovery](../../T1652/T1652.md) | [Remote Services: SMB/Windows Admin Shares](../../T1021.002/T1021.002.md) | [Audio Capture](../../T1123/T1123.md) | Exfiltration Over Symmetric Encrypted Non-C2 Protocol [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Application Layer Protocol](../../T1071/T1071.md) | Stored Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Exploit Public-Facing Application [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Scheduled Task/Job: Cron](../../T1053.003/T1053.003.md) | [External Remote Services](../../T1133/T1133.md) | [Kubernetes Cronjob](../../T1053.007/T1053.007.md) | File/Path Exclusions [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Unsecured Credentials: Cloud Instance Metadata API](../../T1552.005/T1552.005.md) | [Account Discovery: Domain Account](../../T1087.002/T1087.002.md) | Use Alternate Authentication Material [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Archive via Custom Method [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Traffic Duplication [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Remote Access Software](../../T1219/T1219.md) | [Service Stop](../../T1489/T1489.md) |
|
||||
| Content Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Component Object Model [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Abuse Elevation Control Mechanism: Bypass User Account Control](../../T1548.002/T1548.002.md) | [File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification](../../T1222.002/T1222.002.md) | Securityd Memory [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Account Discovery: Local Account](../../T1087.001/T1087.001.md) | Remote Services [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Email Collection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration to Code Repository [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Content Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Application or System Exploitation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Valid Accounts: Default Accounts](../../T1078.001/T1078.001.md) | Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Kubernetes Cronjob](../../T1053.007/T1053.007.md) | [Abuse Elevation Control Mechanism: Sudo and Sudo Caching](../../T1548.003/T1548.003.md) | [Signed Script Proxy Execution: Pubprn](../../T1216.001/T1216.001.md) | [Brute Force: Password Cracking](../../T1110.002/T1110.002.md) | [Virtualization/Sandbox Evasion: System Checks](../../T1497.001/T1497.001.md) | Remote Service Session Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Data from Removable Media [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](../../T1048.002/T1048.002.md) | Traffic Signaling [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Runtime Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
| Compromise Software Dependencies and Development Tools [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Windows Management Instrumentation](../../T1047/T1047.md) | Socket Filters [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Scheduled Task/Job: Scheduled Task](../../T1053.005/T1053.005.md) | Socket Filters [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Input Capture: Keylogging](../../T1056.001/T1056.001.md) | Internet Connection Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Taint Shared Content [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Screen Capture](../../T1113/T1113.md) | Exfiltration Over Webhook [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Data Encoding: Standard Encoding](../../T1132.001/T1132.001.md) | Direct Network Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Spearphishing Link [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Server Software Component](../../T1129/T1129.md) | Boot or Logon Initialization Scripts [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Boot or Logon Initialization Scripts [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Fileless Storage [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Brute Force: Password Guessing](../../T1110.001/T1110.001.md) | Permission Groups Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Replication Through Removable Media](../../T1091/T1091.md) | Adversary-in-the-Middle [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Scheduled Transfer [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Domain Generation Algorithms [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | External Defacement [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Phishing: Spearphishing Attachment](../../T1566.001/T1566.001.md) | [Command and Scripting Interpreter: JavaScript](../../T1059.007/T1059.007.md) | Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Signed Binary Proxy Execution: Rundll32](../../T1218.011/T1218.011.md) | [OS Credential Dumping](../../T1003/T1003.md) | [Group Policy Discovery](../../T1615/T1615.md) | [Remote Services: SMB/Windows Admin Shares](../../T1021.002/T1021.002.md) | [Input Capture: Keylogging](../../T1056.001/T1056.001.md) | Exfiltration Over Other Network Medium [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Application Layer Protocol: DNS](../../T1071.004/T1071.004.md) | OS Exhaustion Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Compromise Hardware Supply Chain [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Inter-Process Communication: Dynamic Data Exchange](../../T1559.002/T1559.002.md) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | Embedded Payloads [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Steal Web Session Cookie](../../T1539/T1539.md) | Device Driver Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Use Alternate Authentication Material [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Sharepoint [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration Over Bluetooth [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Symmetric Cryptography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Application Exhaustion Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Compromise Hardware Supply Chain [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Inter-Process Communication: Dynamic Data Exchange](../../T1559.002/T1559.002.md) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | [Event Triggered Execution: PowerShell Profile](../../T1546.013/T1546.013.md) | Embedded Payloads [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Steal Web Session Cookie](../../T1539/T1539.md) | [Device Driver Discovery](../../T1652/T1652.md) | Use Alternate Authentication Material [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Sharepoint [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration Over Bluetooth [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Symmetric Cryptography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Application Exhaustion Flood [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Replication Through Removable Media](../../T1091/T1091.md) | [User Execution: Malicious File](../../T1204.002/T1204.002.md) | Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Create or Modify System Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | File/Path Exclusions [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping: Security Account Manager](../../T1003.002/T1003.002.md) | [Account Discovery: Domain Account](../../T1087.002/T1087.002.md) | Remote Services [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Audio Capture](../../T1123/T1123.md) | [Automated Exfiltration](../../T1020/T1020.md) | Fast Flux DNS [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Disk Wipe [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| [Supply Chain Compromise](../../T1195/T1195.md) | Component Object Model [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [External Remote Services](../../T1133/T1133.md) | [Abuse Elevation Control Mechanism: Bypass User Account Control](../../T1548.002/T1548.002.md) | [Signed Script Proxy Execution: Pubprn](../../T1216.001/T1216.001.md) | [Brute Force: Password Cracking](../../T1110.002/T1110.002.md) | [Account Discovery: Local Account](../../T1087.001/T1087.001.md) | Remote Service Session Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Archive via Custom Method [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration Over Symmetric Encrypted Non-C2 Protocol [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Application Layer Protocol](../../T1071/T1071.md) | Stored Data Manipulation [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) |
|
||||
| Exploit Public-Facing Application [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Scheduled Task/Job [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Pre-OS Boot: System Firmware](../../T1542.001/T1542.001.md) | [Hijack Execution Flow: Services Registry Permissions Weakness](../../T1574.011/T1574.011.md) | Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [OS Credential Dumping: LSA Secrets](../../T1003.004/T1003.004.md) | [Virtualization/Sandbox Evasion: System Checks](../../T1497.001/T1497.001.md) | [Remote Services: Windows Remote Management](../../T1021.006/T1021.006.md) | Email Collection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Exfiltration to Code Repository [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Remote Access Software](../../T1219/T1219.md) | [Service Stop](../../T1489/T1489.md) |
|
||||
|
||||
@@ -50046,6 +50046,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -49213,6 +49213,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -48707,6 +48707,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -48533,6 +48533,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -49138,6 +49138,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -49348,6 +49348,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -49073,6 +49073,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
+22
-15
@@ -96578,7 +96578,28 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
atomic_tests: []
|
||||
identifier: T1652
|
||||
atomic_tests:
|
||||
- name: Device Driver Discovery
|
||||
auto_generated_guid: 235b30a2-e5b1-441f-9705-be6231c88ddd
|
||||
description: "Displays a list of installed device drivers on the local computer
|
||||
and their properties. Threat actors use this command to enumerate the existing
|
||||
drivers on the computer. \nParameters: \n/v /fo list - Displays verbose output
|
||||
in a list format - the /v parameter is not valid for signed drivers\n/si /fo
|
||||
list - Provides information about signed drivers and outputs it in a list
|
||||
format\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
dependency_executor_name:
|
||||
dependencies:
|
||||
executor:
|
||||
command: |
|
||||
driverquery /v /fo list
|
||||
driverquery /si /fo list
|
||||
cleanup_command:
|
||||
name: powershell
|
||||
elevation_required: false
|
||||
T1087.002:
|
||||
technique:
|
||||
modified: '2024-04-15T21:33:57.732Z'
|
||||
@@ -99697,20 +99718,6 @@ discovery:
|
||||
wmic DISKDRIVE get Caption
|
||||
Get-WmiObject win32_bios
|
||||
name: command_prompt
|
||||
- name: Driver Enumeration using DriverQuery
|
||||
auto_generated_guid: bd85e3d1-4aeb-4a1d-850f-7be3cb8d60b9
|
||||
description: "Executes the driverquery command to list drivers installed on
|
||||
the system. Adversaries utilize the feature to enumerate the driver and it
|
||||
can be\nused for Exploitation. \ncommand /v - provide verbose output but not
|
||||
valid for signed drivers\n /si - provide information about signed drivers
|
||||
\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
executor:
|
||||
command: |
|
||||
driverquery /v
|
||||
driverquery /si
|
||||
name: command_prompt
|
||||
- name: System Information Discovery
|
||||
auto_generated_guid: 4060ee98-01ae-4c8e-8aad-af8300519cc7
|
||||
description: 'The script gathernetworkinfo.vbs is employed to collect system
|
||||
|
||||
@@ -58679,6 +58679,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -53814,6 +53814,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -48903,6 +48903,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -48533,6 +48533,7 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
identifier: T1652
|
||||
atomic_tests: []
|
||||
T1087.002:
|
||||
technique:
|
||||
|
||||
@@ -79723,7 +79723,28 @@ discovery:
|
||||
x_mitre_attack_spec_version: 3.1.0
|
||||
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
|
||||
spec_version: '2.1'
|
||||
atomic_tests: []
|
||||
identifier: T1652
|
||||
atomic_tests:
|
||||
- name: Device Driver Discovery
|
||||
auto_generated_guid: 235b30a2-e5b1-441f-9705-be6231c88ddd
|
||||
description: "Displays a list of installed device drivers on the local computer
|
||||
and their properties. Threat actors use this command to enumerate the existing
|
||||
drivers on the computer. \nParameters: \n/v /fo list - Displays verbose output
|
||||
in a list format - the /v parameter is not valid for signed drivers\n/si /fo
|
||||
list - Provides information about signed drivers and outputs it in a list
|
||||
format\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
dependency_executor_name:
|
||||
dependencies:
|
||||
executor:
|
||||
command: |
|
||||
driverquery /v /fo list
|
||||
driverquery /si /fo list
|
||||
cleanup_command:
|
||||
name: powershell
|
||||
elevation_required: false
|
||||
T1087.002:
|
||||
technique:
|
||||
modified: '2024-04-15T21:33:57.732Z'
|
||||
@@ -81807,20 +81828,6 @@ discovery:
|
||||
wmic DISKDRIVE get Caption
|
||||
Get-WmiObject win32_bios
|
||||
name: command_prompt
|
||||
- name: Driver Enumeration using DriverQuery
|
||||
auto_generated_guid: bd85e3d1-4aeb-4a1d-850f-7be3cb8d60b9
|
||||
description: "Executes the driverquery command to list drivers installed on
|
||||
the system. Adversaries utilize the feature to enumerate the driver and it
|
||||
can be\nused for Exploitation. \ncommand /v - provide verbose output but not
|
||||
valid for signed drivers\n /si - provide information about signed drivers
|
||||
\n"
|
||||
supported_platforms:
|
||||
- windows
|
||||
executor:
|
||||
command: |
|
||||
driverquery /v
|
||||
driverquery /si
|
||||
name: command_prompt
|
||||
- name: System Information Discovery
|
||||
auto_generated_guid: 4060ee98-01ae-4c8e-8aad-af8300519cc7
|
||||
description: 'The script gathernetworkinfo.vbs is employed to collect system
|
||||
|
||||
+10
-44
@@ -62,17 +62,15 @@ Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure a
|
||||
|
||||
- [Atomic Test #27 - System Information Discovery with WMIC](#atomic-test-27---system-information-discovery-with-wmic)
|
||||
|
||||
- [Atomic Test #28 - Driver Enumeration using DriverQuery](#atomic-test-28---driver-enumeration-using-driverquery)
|
||||
- [Atomic Test #28 - System Information Discovery](#atomic-test-28---system-information-discovery)
|
||||
|
||||
- [Atomic Test #29 - System Information Discovery](#atomic-test-29---system-information-discovery)
|
||||
- [Atomic Test #29 - Check computer location](#atomic-test-29---check-computer-location)
|
||||
|
||||
- [Atomic Test #30 - Check computer location](#atomic-test-30---check-computer-location)
|
||||
- [Atomic Test #30 - BIOS Information Discovery through Registry](#atomic-test-30---bios-information-discovery-through-registry)
|
||||
|
||||
- [Atomic Test #31 - BIOS Information Discovery through Registry](#atomic-test-31---bios-information-discovery-through-registry)
|
||||
- [Atomic Test #31 - ESXi - VM Discovery using ESXCLI](#atomic-test-31---esxi---vm-discovery-using-esxcli)
|
||||
|
||||
- [Atomic Test #32 - ESXi - VM Discovery using ESXCLI](#atomic-test-32---esxi---vm-discovery-using-esxcli)
|
||||
|
||||
- [Atomic Test #33 - ESXi - Darkside system information discovery](#atomic-test-33---esxi---darkside-system-information-discovery)
|
||||
- [Atomic Test #32 - ESXi - Darkside system information discovery](#atomic-test-32---esxi---darkside-system-information-discovery)
|
||||
|
||||
|
||||
<br/>
|
||||
@@ -976,39 +974,7 @@ Get-WmiObject win32_bios
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #28 - Driver Enumeration using DriverQuery
|
||||
Executes the driverquery command to list drivers installed on the system. Adversaries utilize the feature to enumerate the driver and it can be
|
||||
used for Exploitation.
|
||||
command /v - provide verbose output but not valid for signed drivers
|
||||
/si - provide information about signed drivers
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** bd85e3d1-4aeb-4a1d-850f-7be3cb8d60b9
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
|
||||
```cmd
|
||||
driverquery /v
|
||||
driverquery /si
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #29 - System Information Discovery
|
||||
## Atomic Test #28 - System Information Discovery
|
||||
The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
@@ -1036,7 +1002,7 @@ wscript.exe C:\Windows\System32\gatherNetworkInfo.vbs
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #30 - Check computer location
|
||||
## Atomic Test #29 - Check computer location
|
||||
Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed.
|
||||
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
|
||||
|
||||
@@ -1065,7 +1031,7 @@ reg query "HKEY_CURRENT_USER\Control Panel\International\Geo"
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #31 - BIOS Information Discovery through Registry
|
||||
## Atomic Test #30 - BIOS Information Discovery through Registry
|
||||
Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments. Upon execution, BIOS information will be displayed.
|
||||
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
|
||||
- https://evasions.checkpoint.com/techniques/registry.html
|
||||
@@ -1096,7 +1062,7 @@ reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v VideoBiosVersion
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #32 - ESXi - VM Discovery using ESXCLI
|
||||
## Atomic Test #31 - ESXi - VM Discovery using ESXCLI
|
||||
An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine.
|
||||
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)
|
||||
|
||||
@@ -1147,7 +1113,7 @@ Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -O
|
||||
<br/>
|
||||
<br/>
|
||||
|
||||
## Atomic Test #33 - ESXi - Darkside system information discovery
|
||||
## Atomic Test #32 - ESXi - Darkside system information discovery
|
||||
Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host.
|
||||
[Reference](https://www.trendmicro.com/en_ph/research/21/e/darkside-linux-vms-targeted.html)
|
||||
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
# T1652 - Device Driver Discovery
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1652)
|
||||
<blockquote>Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).
|
||||
|
||||
Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)
|
||||
|
||||
On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)</blockquote>
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - Device Driver Discovery](#atomic-test-1---device-driver-discovery)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
## Atomic Test #1 - Device Driver Discovery
|
||||
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer.
|
||||
Parameters:
|
||||
/v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers
|
||||
/si /fo list - Provides information about signed drivers and outputs it in a list format
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 235b30a2-e5b1-441f-9705-be6231c88ddd
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `powershell`!
|
||||
|
||||
|
||||
```powershell
|
||||
driverquery /v /fo list
|
||||
driverquery /si /fo list
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
@@ -3,7 +3,7 @@ display_name: "Device Driver Discovery"
|
||||
atomic_tests:
|
||||
|
||||
- name: Device Driver Discovery
|
||||
auto_generated_guid:
|
||||
auto_generated_guid: 235b30a2-e5b1-441f-9705-be6231c88ddd
|
||||
description: |
|
||||
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer.
|
||||
Parameters:
|
||||
|
||||
@@ -1617,3 +1617,4 @@ b4ca838d-d013-4461-bf2c-f7132617b409
|
||||
6934c16e-0b3a-4e7f-ab8c-c414acd32181
|
||||
9e55750e-4cbf-4013-9627-e9a045b541bf
|
||||
ecbd533e-b45d-4239-aeff-b857c6f6d68b
|
||||
235b30a2-e5b1-441f-9705-be6231c88ddd
|
||||
|
||||
Reference in New Issue
Block a user