security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate GUIDs from job=generate-docs branch=master [skip ci]

Browse Source
This commit is contained in:
Atomic Red Team GUID generator
2023-12-04 18:31:36 +00:00
parent 0e7356bccb
commit d46b0d874e
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1112/T1112.yaml
+1
View File
@@ -947,6 +947,7 @@ atomic_tests:
reg add "HKLM\SOFTWARE\Policies\Microsoft\SecondaryAuthenticationFactor" /v "AllowSecondaryAuthenticationDevice" /t REG_DWORD /d 1 /f
name: command_prompt
- name: Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value.
auto_generated_guid: ffeddced-bb9f-49c6-97f0-3d07a509bf94
description: |
Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon).
atomics/used_guids.txt
+1
View File
@@ -1521,3 +1521,4 @@ a0c1725f-abcd-40d6-baac-020f3cf94ecd
2871ed59-3837-4a52-9107-99500ebc87cb
2a3c7035-d14f-467a-af94-933e49fe6786
ae56083f-28d0-417d-84da-df4242da1f7c
ffeddced-bb9f-49c6-97f0-3d07a509bf94