diff --git a/atomics/T1022/T1022.md b/atomics/T1022/T1022.md index d00ca6aa..93c58c81 100644 --- a/atomics/T1022/T1022.md +++ b/atomics/T1022/T1022.md @@ -6,12 +6,18 @@ Other exfiltration techniques likely apply as well to transfer the information o ## Atomic Tests -- [Atomic Test #1 - Data Encrypted](#atomic-test-1---data-encrypted) +- [Atomic Test #1 - Data Encrypted with zip and gpg](#atomic-test-1---data-encrypted-with-zip-and-gpg) + +- [Atomic Test #2 - Compress Data and lock with password for Exfiltration with winrar](#atomic-test-2---compress-data-and-lock-with-password-for-exfiltration-with-winrar) + +- [Atomic Test #3 - Compress Data and lock with password for Exfiltration with winzip](#atomic-test-3---compress-data-and-lock-with-password-for-exfiltration-with-winzip) + +- [Atomic Test #4 - Compress Data and lock with password for Exfiltration with 7zip](#atomic-test-4---compress-data-and-lock-with-password-for-exfiltration-with-7zip)
-## Atomic Test #1 - Data Encrypted +## Atomic Test #1 - Data Encrypted with zip and gpg Encrypt data for exiltration **Supported Platforms:** macOS, CentOS, Ubuntu, Linux @@ -29,3 +35,57 @@ gpg -c /tmp/victim-gpg.txt ls -l ```
+
+ +## Atomic Test #2 - Compress Data and lock with password for Exfiltration with winrar +Note: Requires winrar installation +rar a -p"blue" hello.rar (VARIANT) + +**Supported Platforms:** Windows + + +#### Run it with `command_prompt`! +``` +mkdir ./tmp/victim-files +cd ./tmp/victim-files +echo "This file will be encrypted" > ./encrypted_file.txt +rar a -hp"blue" hello.rar +dir +``` +
+
+ +## Atomic Test #3 - Compress Data and lock with password for Exfiltration with winzip +Note: Requires winzip installation +wzzip sample.zip -s"blueblue" *.txt (VARIANT) + +**Supported Platforms:** Windows + + +#### Run it with `command_prompt`! +``` +path=%path%;"C:\Program Files (x86)\winzip" +mkdir ./tmp/victim-files +cd ./tmp/victim-files +echo "This file will be encrypted" > ./encrypted_file.txt +winzip32 -min -a -s"hello" archive.zip * +dir +``` +
+
+ +## Atomic Test #4 - Compress Data and lock with password for Exfiltration with 7zip +Note: Requires 7zip installation + +**Supported Platforms:** Windows + + +#### Run it with `command_prompt`! +``` +mkdir ./tmp/victim-files +cd ./tmp/victim-files +echo "This file will be encrypted" > ./encrypted_file.txt +7z a archive.7z -pblue +dir +``` +
diff --git a/atomics/T1022/T1022.yaml b/atomics/T1022/T1022.yaml index 9ef8f677..cb4a1673 100644 --- a/atomics/T1022/T1022.yaml +++ b/atomics/T1022/T1022.yaml @@ -3,10 +3,9 @@ attack_technique: T1022 display_name: Data Encrypted atomic_tests: -- name: Data Encrypted +- name: Data Encrypted with zip and gpg description: | Encrypt data for exiltration - supported_platforms: - macos - centos @@ -24,3 +23,48 @@ atomic_tests: gpg -c /tmp/victim-gpg.txt ls -l + +- name: Compress Data and lock with password for Exfiltration with winrar + description: | + Note: Requires winrar installation + rar a -p"blue" hello.rar (VARIANT) + supported_platforms: + - windows + executor: + name: command_prompt + command: | + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + rar a -hp"blue" hello.rar + dir + +- name: Compress Data and lock with password for Exfiltration with winzip + description: | + Note: Requires winzip installation + wzzip sample.zip -s"blueblue" *.txt (VARIANT) + supported_platforms: + - windows + executor: + name: command_prompt + command: | + path=%path%;"C:\Program Files (x86)\winzip" + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + winzip32 -min -a -s"hello" archive.zip * + dir + +- name: Compress Data and lock with password for Exfiltration with 7zip + description: | + Note: Requires 7zip installation + supported_platforms: + - windows + executor: + name: command_prompt + command: | + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + 7z a archive.7z -pblue + dir diff --git a/atomics/index.md b/atomics/index.md index f432f1d3..4e9d3d97 100644 --- a/atomics/index.md +++ b/atomics/index.md @@ -696,7 +696,10 @@ - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] - [T1022 Data Encrypted](./T1022/T1022.md) - - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux] + - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux] + - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows] + - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows] + - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows] - [T1030 Data Transfer Size Limits](./T1030/T1030.md) - Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux] - [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) diff --git a/atomics/index.yaml b/atomics/index.yaml index 1d6cbe09..1674fe97 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -18990,7 +18990,7 @@ exfiltration: created: '2017-05-31T21:30:30.260Z' identifier: T1022 atomic_tests: - - name: Data Encrypted + - name: Data Encrypted with zip and gpg description: 'Encrypt data for exiltration ' @@ -19010,6 +19010,49 @@ exfiltration: gpg -c /tmp/victim-gpg.txt ls -l + - name: Compress Data and lock with password for Exfiltration with winrar + description: | + Note: Requires winrar installation + rar a -p"blue" hello.rar (VARIANT) + supported_platforms: + - windows + executor: + name: command_prompt + command: | + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + rar a -hp"blue" hello.rar + dir + - name: Compress Data and lock with password for Exfiltration with winzip + description: | + Note: Requires winzip installation + wzzip sample.zip -s"blueblue" *.txt (VARIANT) + supported_platforms: + - windows + executor: + name: command_prompt + command: | + path=%path%;"C:\Program Files (x86)\winzip" + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + winzip32 -min -a -s"hello" archive.zip * + dir + - name: Compress Data and lock with password for Exfiltration with 7zip + description: 'Note: Requires 7zip installation + +' + supported_platforms: + - windows + executor: + name: command_prompt + command: | + mkdir ./tmp/victim-files + cd ./tmp/victim-files + echo "This file will be encrypted" > ./encrypted_file.txt + 7z a archive.7z -pblue + dir T1030: technique: id: attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd diff --git a/atomics/linux-index.md b/atomics/linux-index.md index 650220f6..70b71528 100644 --- a/atomics/linux-index.md +++ b/atomics/linux-index.md @@ -107,7 +107,7 @@ - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] - [T1022 Data Encrypted](./T1022/T1022.md) - - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux] + - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux] - [T1030 Data Transfer Size Limits](./T1030/T1030.md) - Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux] - [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) diff --git a/atomics/macos-index.md b/atomics/macos-index.md index 98cf1083..f17ef5ba 100644 --- a/atomics/macos-index.md +++ b/atomics/macos-index.md @@ -163,7 +163,7 @@ - Atomic Test #4: Data Compressed - nix - gzip Single File [linux, macos] - Atomic Test #5: Data Compressed - nix - tar Folder or File [linux, macos] - [T1022 Data Encrypted](./T1022/T1022.md) - - Atomic Test #1: Data Encrypted [macos, centos, ubuntu, linux] + - Atomic Test #1: Data Encrypted with zip and gpg [macos, centos, ubuntu, linux] - [T1030 Data Transfer Size Limits](./T1030/T1030.md) - Atomic Test #1: Data Transfer Size Limits [macos, centos, ubuntu, linux] - [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) diff --git a/atomics/windows-index.md b/atomics/windows-index.md index c6cfdf2f..4dd77d78 100644 --- a/atomics/windows-index.md +++ b/atomics/windows-index.md @@ -412,6 +412,9 @@ - Atomic Test #1: Compress Data for Exfiltration With PowerShell [windows] - Atomic Test #2: Compress Data for Exfiltration With Rar [windows] - [T1022 Data Encrypted](./T1022/T1022.md) + - Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows] + - Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows] + - Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows] - [T1030 Data Transfer Size Limits](./T1030/T1030.md) - [T1048 Exfiltration Over Alternative Protocol](./T1048/T1048.md) - T1041 Exfiltration Over Command and Control Channel [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)