security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate docs from job=validate_atomics_generate_docs branch=master

Browse Source
This commit is contained in:
CircleCI Atomic Red Team doc generator
2020-03-02 20:30:10 +00:00
parent 6b6f7f1a48
commit ed32225707
2 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1015/T1015.md
+2 -4
View File
@@ -34,10 +34,8 @@ Attaches cmd.exe to a list of processes. Configure your own Input arguments to a
#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| parent_list | Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe"
| String | osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe|
| attached_process | Full path to process to attach to target in #{parent_list}. Default: cmd.exe
| Path | C:\windows\system32\cmd.exe|
| parent_list | Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: "osk.exe" | String | osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe|
| attached_process | Full path to process to attach to target in #{parent_list}. Default: cmd.exe | Path | C:\windows\system32\cmd.exe|
#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)
atomics/T1204/T1204.md
+1 -2
View File
@@ -33,8 +33,7 @@ References:
|------|-------------|------|---------------|
| ms_office_version | Microsoft Office version number found in "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office" | String | 16.0|
| ms_product | Maldoc application Word or Excel | String | Word|
| jse_path | Path for the macro to write out the "malicious" .jse file
| String | C:\Users\Public\art.jse|
| jse_path | Path for the macro to write out the "malicious" .jse file | String | C:\Users\Public\art.jse|
#### Attack Commands: Run with `powershell`!