Merge pull request #274 from swelcher/T1065fix

T1065 added
2018-06-27 07:18:54 -04:00
parent eaa3a22167 d4c966f6de
commit f4a63f7985
1 changed files with 50 additions and 0 deletions
@@ -0,0 +1,50 @@
+---
+attack_technique: T1065
+display_name: Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls.
+
+atomic_tests:
+- name: Testing usage of uncommonly used port with PowerShell
+  description: |
+    Testing uncommonly used port utilizing PowerShell
+
+  supported_platforms:
+    - windows
+
+  input_arguments:
+    port:
+      description: Specify uncommon port number
+      type: String
+      default: 8081
+    hostname:
+      description: Specify target hostname
+      type: String
+      default: google.com
+
+  executor:
+    name: powershell
+    command: |
+      test-netconnection -ComputerName #{hostname} -port #{port}
+
+- name: Testing usage of uncommonly used port
+  description: |
+    Testing uncommonly used port utilizing telnet.
+
+  supported_platforms:
+    - linux
+    - macos
+
+  input_arguments:
+    port:
+      description: Specify uncommon port number
+      type: String
+      default: 8081
+    hostname:
+      description: Specify target hostname
+      type: String
+      default: google.com
+
+  executor:
+    name: sh
+    command: |
+      telnet #{hostname} #{port}
+