security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generated docs from job=generate-docs branch=master [ci skip]

Browse Source
This commit is contained in:
Atomic Red Team doc generator
2025-09-05 10:52:40 +00:00
parent 23d78e9c2c
commit c79bb6c63b
8 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-linux.json
+1 -1
View File
File diff suppressed because one or more lines are too long
atomics/Indexes/Indexes-CSV/index.csv
+1 -1
View File
@@ -2204,7 +2204,7 @@ impact,T1529,System Shutdown/Reboot,12,Logoff System - Windows,3d8c25b5-7ff5-4c9
impact,T1529,System Shutdown/Reboot,13,ESXi - Terminates VMs using pkill,987c9b4d-a637-42db-b1cb-e9e242c3991b,command_prompt
impact,T1529,System Shutdown/Reboot,14,ESXi - Avoslocker enumerates VMs and forcefully kills VMs,189f7d6e-9442-4160-9bc3-5e4104d93ece,command_prompt
impact,T1529,System Shutdown/Reboot,15,ESXi - vim-cmd Used to Power Off VMs,622cc1a0-45e7-428c-aed7-c96dd605fbe6,command_prompt
impact,T1529,System Shutdown/Reboot,16,abuse of linux magic system request key for reboot,d2a1f4bc-a064-4223-8281-a086dce5423c,bash
impact,T1529,System Shutdown/Reboot,16,Abuse of Linux Magic System Request Key for Reboot,d2a1f4bc-a064-4223-8281-a086dce5423c,bash
initial-access,T1133,External Remote Services,1,Running Chrome VPN Extensions via the Registry 2 vpn extension,4c8db261-a58b-42a6-a866-0a294deedde4,powershell
initial-access,T1566.002,Phishing: Spearphishing Link,1,Paste and run technique,bc177ef9-6a12-4ebc-a2ec-d41e19c2791d,powershell
initial-access,T1566.001,Phishing: Spearphishing Attachment,1,Download Macro-Enabled Phishing Attachment,114ccff9-ae6d-4547-9ead-4cd69f687306,powershell
1 Tactic Technique # Technique Name Test # Test Name Test GUID Executor Name
2204 impact T1529 System Shutdown/Reboot 13 ESXi - Terminates VMs using pkill 987c9b4d-a637-42db-b1cb-e9e242c3991b command_prompt
2205 impact T1529 System Shutdown/Reboot 14 ESXi - Avoslocker enumerates VMs and forcefully kills VMs 189f7d6e-9442-4160-9bc3-5e4104d93ece command_prompt
2206 impact T1529 System Shutdown/Reboot 15 ESXi - vim-cmd Used to Power Off VMs 622cc1a0-45e7-428c-aed7-c96dd605fbe6 command_prompt
2207 impact T1529 System Shutdown/Reboot 16 abuse of linux magic system request key for reboot Abuse of Linux Magic System Request Key for Reboot d2a1f4bc-a064-4223-8281-a086dce5423c bash
2208 initial-access T1133 External Remote Services 1 Running Chrome VPN Extensions via the Registry 2 vpn extension 4c8db261-a58b-42a6-a866-0a294deedde4 powershell
2209 initial-access T1566.002 Phishing: Spearphishing Link 1 Paste and run technique bc177ef9-6a12-4ebc-a2ec-d41e19c2791d powershell
2210 initial-access T1566.001 Phishing: Spearphishing Attachment 1 Download Macro-Enabled Phishing Attachment 114ccff9-ae6d-4547-9ead-4cd69f687306 powershell
atomics/Indexes/Indexes-CSV/linux-index.csv
+1 -1
View File
@@ -441,7 +441,7 @@ impact,T1529,System Shutdown/Reboot,8,Reboot System via `halt` - Linux,78f92e14-
impact,T1529,System Shutdown/Reboot,9,Shutdown System via `poweroff` - FreeBSD/Linux,73a90cd2-48a2-4ac5-8594-2af35fa909fa,sh
impact,T1529,System Shutdown/Reboot,10,Reboot System via `poweroff` - FreeBSD,5a282e50-86ff-438d-8cef-8ae01c9e62e1,sh
impact,T1529,System Shutdown/Reboot,11,Reboot System via `poweroff` - Linux,61303105-ff60-427b-999e-efb90b314e41,bash
impact,T1529,System Shutdown/Reboot,16,abuse of linux magic system request key for reboot,d2a1f4bc-a064-4223-8281-a086dce5423c,bash
impact,T1529,System Shutdown/Reboot,16,Abuse of Linux Magic System Request Key for Reboot,d2a1f4bc-a064-4223-8281-a086dce5423c,bash
initial-access,T1078.003,Valid Accounts: Local Accounts,8,Create local account (Linux),02a91c34-8a5b-4bed-87af-501103eb5357,bash
initial-access,T1078.003,Valid Accounts: Local Accounts,9,Reactivate a locked/expired account (Linux),d2b95631-62d7-45a3-aaef-0972cea97931,bash
initial-access,T1078.003,Valid Accounts: Local Accounts,10,Reactivate a locked/expired account (FreeBSD),09e3380a-fae5-4255-8b19-9950be0252cf,sh
1 Tactic Technique # Technique Name Test # Test Name Test GUID Executor Name
441 impact T1529 System Shutdown/Reboot 9 Shutdown System via `poweroff` - FreeBSD/Linux 73a90cd2-48a2-4ac5-8594-2af35fa909fa sh
442 impact T1529 System Shutdown/Reboot 10 Reboot System via `poweroff` - FreeBSD 5a282e50-86ff-438d-8cef-8ae01c9e62e1 sh
443 impact T1529 System Shutdown/Reboot 11 Reboot System via `poweroff` - Linux 61303105-ff60-427b-999e-efb90b314e41 bash
444 impact T1529 System Shutdown/Reboot 16 abuse of linux magic system request key for reboot Abuse of Linux Magic System Request Key for Reboot d2a1f4bc-a064-4223-8281-a086dce5423c bash
445 initial-access T1078.003 Valid Accounts: Local Accounts 8 Create local account (Linux) 02a91c34-8a5b-4bed-87af-501103eb5357 bash
446 initial-access T1078.003 Valid Accounts: Local Accounts 9 Reactivate a locked/expired account (Linux) d2b95631-62d7-45a3-aaef-0972cea97931 bash
447 initial-access T1078.003 Valid Accounts: Local Accounts 10 Reactivate a locked/expired account (FreeBSD) 09e3380a-fae5-4255-8b19-9950be0252cf sh
atomics/Indexes/Indexes-Markdown/index.md
+1 -1
View File
@@ -3060,7 +3060,7 @@
- Atomic Test #13: ESXi - Terminates VMs using pkill [windows]
- Atomic Test #14: ESXi - Avoslocker enumerates VMs and forcefully kills VMs [windows]
- Atomic Test #15: ESXi - vim-cmd Used to Power Off VMs [windows]
- Atomic Test #16: abuse of linux magic system request key for reboot [linux]
- Atomic Test #16: Abuse of Linux Magic System Request Key for Reboot [linux]
# initial-access
- [T1133 External Remote Services](../../T1133/T1133.md)
atomics/Indexes/Indexes-Markdown/linux-index.md
+1 -1
View File
@@ -870,7 +870,7 @@
- Atomic Test #9: Shutdown System via `poweroff` - FreeBSD/Linux [linux]
- Atomic Test #10: Reboot System via `poweroff` - FreeBSD [linux]
- Atomic Test #11: Reboot System via `poweroff` - Linux [linux]
- Atomic Test #16: abuse of linux magic system request key for reboot [linux]
- Atomic Test #16: Abuse of Linux Magic System Request Key for Reboot [linux]
# initial-access
- T1133 External Remote Services [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
atomics/Indexes/index.yaml
+1 -2
View File
@@ -123103,7 +123103,7 @@ impact:
'
name: command_prompt
elevation_required: false
- name: abuse of linux magic system request key for reboot
- name: Abuse of Linux Magic System Request Key for Reboot
auto_generated_guid: d2a1f4bc-a064-4223-8281-a086dce5423c
description: 'adversaries with root or sufficient privileges to silently manipulate
or destabilize a system. By writing to /proc/sysrq-trigger, they can forced
@@ -123112,7 +123112,6 @@ impact:
'
supported_platforms:
- linux
dependency_executor_name: bash
executor:
command: 'echo "b" > /proc/sysrq-trigger
atomics/Indexes/linux-index.yaml
+1 -2
View File
@@ -73155,7 +73155,7 @@ impact:
'
name: bash
elevation_required: true
- name: abuse of linux magic system request key for reboot
- name: Abuse of Linux Magic System Request Key for Reboot
auto_generated_guid: d2a1f4bc-a064-4223-8281-a086dce5423c
description: 'adversaries with root or sufficient privileges to silently manipulate
or destabilize a system. By writing to /proc/sysrq-trigger, they can forced
@@ -73164,7 +73164,6 @@ impact:
'
supported_platforms:
- linux
dependency_executor_name: bash
executor:
command: 'echo "b" > /proc/sysrq-trigger
atomics/T1529/T1529.md
+2 -2
View File
@@ -42,7 +42,7 @@ Adversaries may attempt to shutdown/reboot a system after impacting it in other
- [Atomic Test #15 - ESXi - vim-cmd Used to Power Off VMs](#atomic-test-15---esxi---vim-cmd-used-to-power-off-vms)
- [Atomic Test #16 - abuse of linux magic system request key for reboot](#atomic-test-16---abuse-of-linux-magic-system-request-key-for-reboot)
- [Atomic Test #16 - Abuse of Linux Magic System Request Key for Reboot](#atomic-test-16---abuse-of-linux-magic-system-request-key-for-reboot)
<br/>
@@ -555,7 +555,7 @@ Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -O
<br/>
<br/>
## Atomic Test #16 - abuse of linux magic system request key for reboot
## Atomic Test #16 - Abuse of Linux Magic System Request Key for Reboot
adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.
**Supported Platforms:** Linux