diff --git a/atomics/T1022/T1022.md b/atomics/T1022/T1022.md
index d00ca6aa..93c58c81 100644
--- a/atomics/T1022/T1022.md
+++ b/atomics/T1022/T1022.md
@@ -6,12 +6,18 @@ Other exfiltration techniques likely apply as well to transfer the information o
## Atomic Tests
-- [Atomic Test #1 - Data Encrypted](#atomic-test-1---data-encrypted)
+- [Atomic Test #1 - Data Encrypted with zip and gpg](#atomic-test-1---data-encrypted-with-zip-and-gpg)
+
+- [Atomic Test #2 - Compress Data and lock with password for Exfiltration with winrar](#atomic-test-2---compress-data-and-lock-with-password-for-exfiltration-with-winrar)
+
+- [Atomic Test #3 - Compress Data and lock with password for Exfiltration with winzip](#atomic-test-3---compress-data-and-lock-with-password-for-exfiltration-with-winzip)
+
+- [Atomic Test #4 - Compress Data and lock with password for Exfiltration with 7zip](#atomic-test-4---compress-data-and-lock-with-password-for-exfiltration-with-7zip)
-## Atomic Test #1 - Data Encrypted
+## Atomic Test #1 - Data Encrypted with zip and gpg
Encrypt data for exiltration
**Supported Platforms:** macOS, CentOS, Ubuntu, Linux
@@ -29,3 +35,57 @@ gpg -c /tmp/victim-gpg.txt
ls -l
```
+
+
+## Atomic Test #2 - Compress Data and lock with password for Exfiltration with winrar
+Note: Requires winrar installation
+rar a -p"blue" hello.rar (VARIANT)
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+mkdir ./tmp/victim-files
+cd ./tmp/victim-files
+echo "This file will be encrypted" > ./encrypted_file.txt
+rar a -hp"blue" hello.rar
+dir
+```
+
+
+
+## Atomic Test #3 - Compress Data and lock with password for Exfiltration with winzip
+Note: Requires winzip installation
+wzzip sample.zip -s"blueblue" *.txt (VARIANT)
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+path=%path%;"C:\Program Files (x86)\winzip"
+mkdir ./tmp/victim-files
+cd ./tmp/victim-files
+echo "This file will be encrypted" > ./encrypted_file.txt
+winzip32 -min -a -s"hello" archive.zip *
+dir
+```
+
+
+
+## Atomic Test #4 - Compress Data and lock with password for Exfiltration with 7zip
+Note: Requires 7zip installation
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+mkdir ./tmp/victim-files
+cd ./tmp/victim-files
+echo "This file will be encrypted" > ./encrypted_file.txt
+7z a archive.7z -pblue
+dir
+```
+
diff --git a/atomics/T1022/T1022.yaml b/atomics/T1022/T1022.yaml
index 9ef8f677..cb4a1673 100644
--- a/atomics/T1022/T1022.yaml
+++ b/atomics/T1022/T1022.yaml
@@ -3,10 +3,9 @@ attack_technique: T1022
display_name: Data Encrypted
atomic_tests:
-- name: Data Encrypted
+- name: Data Encrypted with zip and gpg
description: |
Encrypt data for exiltration
-
supported_platforms:
- macos
- centos
@@ -24,3 +23,48 @@ atomic_tests:
gpg -c /tmp/victim-gpg.txt
ls -l
+
+- name: Compress Data and lock with password for Exfiltration with winrar
+ description: |
+ Note: Requires winrar installation
+ rar a -p"blue" hello.rar (VARIANT)
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ rar a -hp"blue" hello.rar
+ dir
+
+- name: Compress Data and lock with password for Exfiltration with winzip
+ description: |
+ Note: Requires winzip installation
+ wzzip sample.zip -s"blueblue" *.txt (VARIANT)
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ path=%path%;"C:\Program Files (x86)\winzip"
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ winzip32 -min -a -s"hello" archive.zip *
+ dir
+
+- name: Compress Data and lock with password for Exfiltration with 7zip
+ description: |
+ Note: Requires 7zip installation
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ 7z a archive.7z -pblue
+ dir
diff --git a/atomics/index.md b/atomics/index.md
index f432f1d3..4e9d3d97 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -696,7 +696,10 @@
- Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos]
- Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos]
- [T1022 Data Encrypted](./T1022/T1022.md)
- - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux]
+ - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux]
+ - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows]
+ - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows]
+ - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows]
- [T1030 Data Transfer Size Limits](./T1030/T1030.md)
- Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux]
- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md)
diff --git a/atomics/index.yaml b/atomics/index.yaml
index 1d6cbe09..1674fe97 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -18990,7 +18990,7 @@ exfiltration:
created: '2017-05-31T21:30:30.260Z'
identifier: T1022
atomic_tests:
- - name: Data Encrypted
+ - name: Data Encrypted with zip and gpg
description: 'Encrypt data for exiltration
'
@@ -19010,6 +19010,49 @@ exfiltration:
gpg -c /tmp/victim-gpg.txt
ls -l
+ - name: Compress Data and lock with password for Exfiltration with winrar
+ description: |
+ Note: Requires winrar installation
+ rar a -p"blue" hello.rar (VARIANT)
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ rar a -hp"blue" hello.rar
+ dir
+ - name: Compress Data and lock with password for Exfiltration with winzip
+ description: |
+ Note: Requires winzip installation
+ wzzip sample.zip -s"blueblue" *.txt (VARIANT)
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ path=%path%;"C:\Program Files (x86)\winzip"
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ winzip32 -min -a -s"hello" archive.zip *
+ dir
+ - name: Compress Data and lock with password for Exfiltration with 7zip
+ description: 'Note: Requires 7zip installation
+
+'
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ command: |
+ mkdir ./tmp/victim-files
+ cd ./tmp/victim-files
+ echo "This file will be encrypted" > ./encrypted_file.txt
+ 7z a archive.7z -pblue
+ dir
T1030:
technique:
id: attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd
diff --git a/atomics/linux-index.md b/atomics/linux-index.md
index 650220f6..70b71528 100644
--- a/atomics/linux-index.md
+++ b/atomics/linux-index.md
@@ -107,7 +107,7 @@
- Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos]
- Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos]
- [T1022 Data Encrypted](./T1022/T1022.md)
- - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux]
+ - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux]
- [T1030 Data Transfer Size Limits](./T1030/T1030.md)
- Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux]
- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md)
diff --git a/atomics/macos-index.md b/atomics/macos-index.md
index 98cf1083..f17ef5ba 100644
--- a/atomics/macos-index.md
+++ b/atomics/macos-index.md
@@ -163,7 +163,7 @@
- Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos]
- Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos]
- [T1022 Data Encrypted](./T1022/T1022.md)
- - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux]
+ - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux]
- [T1030 Data Transfer Size Limits](./T1030/T1030.md)
- Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux]
- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md)
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index c6cfdf2f..4dd77d78 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -412,6 +412,9 @@
- Atomic Test #1: Compress Data for Exfiltration With PowerShell [windows]
- Atomic Test #2: Compress Data for Exfiltration With Rar [windows]
- [T1022 Data Encrypted](./T1022/T1022.md)
+ - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows]
+ - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows]
+ - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows]
- [T1030 Data Transfer Size Limits](./T1030/T1030.md)
- [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md)
- T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)