From cf00395732df7b27324b2e7457bc12d746ba2ebf Mon Sep 17 00:00:00 2001 From: CircleCI Atomic Red Team GUID generator Date: Fri, 27 Aug 2021 20:09:26 +0000 Subject: [PATCH] Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] --- atomics/T1134.002/T1134.002.yaml | 1 + atomics/used_guids.txt | 1 + 2 files changed, 2 insertions(+) diff --git a/atomics/T1134.002/T1134.002.yaml b/atomics/T1134.002/T1134.002.yaml index 3b3e2204..f917b80b 100644 --- a/atomics/T1134.002/T1134.002.yaml +++ b/atomics/T1134.002/T1134.002.yaml @@ -2,6 +2,7 @@ attack_technique: T1134.002 display_name: "Create Process with Token" atomic_tests: - name: Access Token Manipulation + auto_generated_guid: dbf4f5a9-b8e0-46a3-9841-9ad71247239e description: | This Action demonstrates how an access token for a specific program can spawn another program under a different owner. Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index bdd565a8..b6a372cd 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -779,3 +779,4 @@ db53959c-207d-4000-9e7a-cd8eb417e072 36753ded-e5c4-4eb5-bc3c-e8fba236878d bc071188-459f-44d5-901a-f8f2625b2d2e d1253f6e-c29b-49dc-b466-2147a6191932 +dbf4f5a9-b8e0-46a3-9841-9ad71247239e