diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 6834c3b2..61ed7e9c 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -1339,7 +1339,7 @@ command-and-control,T1105,Ingress Tool Transfer,1,rsync remote file copy (push), command-and-control,T1105,Ingress Tool Transfer,2,rsync remote file copy (pull),3180f7d5-52c0-4493-9ea0-e3431a84773f,sh command-and-control,T1105,Ingress Tool Transfer,3,scp remote file copy (push),83a49600-222b-4866-80a0-37736ad29344,sh command-and-control,T1105,Ingress Tool Transfer,4,scp remote file copy (pull),b9d22b9a-9778-4426-abf0-568ea64e9c33,sh -command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,sh +command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,bash command-and-control,T1105,Ingress Tool Transfer,6,sftp remote file copy (pull),0139dba1-f391-405e-a4f5-f3989f2c88ef,sh command-and-control,T1105,Ingress Tool Transfer,7,certutil download (urlcache),dd3b61dd-7bbc-48cd-ab51-49ad1a776df0,command_prompt command-and-control,T1105,Ingress Tool Transfer,8,certutil download (verifyctl),ffd492e3-0455-4518-9fb1-46527c9f241b,powershell diff --git a/atomics/Indexes/Indexes-CSV/linux-index.csv b/atomics/Indexes/Indexes-CSV/linux-index.csv index 85764453..327f9913 100644 --- a/atomics/Indexes/Indexes-CSV/linux-index.csv +++ b/atomics/Indexes/Indexes-CSV/linux-index.csv @@ -196,7 +196,7 @@ command-and-control,T1105,Ingress Tool Transfer,1,rsync remote file copy (push), command-and-control,T1105,Ingress Tool Transfer,2,rsync remote file copy (pull),3180f7d5-52c0-4493-9ea0-e3431a84773f,sh command-and-control,T1105,Ingress Tool Transfer,3,scp remote file copy (push),83a49600-222b-4866-80a0-37736ad29344,sh command-and-control,T1105,Ingress Tool Transfer,4,scp remote file copy (pull),b9d22b9a-9778-4426-abf0-568ea64e9c33,sh -command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,sh +command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,bash command-and-control,T1105,Ingress Tool Transfer,6,sftp remote file copy (pull),0139dba1-f391-405e-a4f5-f3989f2c88ef,sh command-and-control,T1105,Ingress Tool Transfer,14,whois file download,c99a829f-0bb8-4187-b2c6-d47d1df74cab,sh command-and-control,T1105,Ingress Tool Transfer,27,Linux Download File and Run,bdc373c5-e9cf-4563-8a7b-a9ba720a90f3,sh diff --git a/atomics/Indexes/Indexes-CSV/macos-index.csv b/atomics/Indexes/Indexes-CSV/macos-index.csv index 3c6f8230..d948a542 100644 --- a/atomics/Indexes/Indexes-CSV/macos-index.csv +++ b/atomics/Indexes/Indexes-CSV/macos-index.csv @@ -128,7 +128,7 @@ command-and-control,T1105,Ingress Tool Transfer,1,rsync remote file copy (push), command-and-control,T1105,Ingress Tool Transfer,2,rsync remote file copy (pull),3180f7d5-52c0-4493-9ea0-e3431a84773f,sh command-and-control,T1105,Ingress Tool Transfer,3,scp remote file copy (push),83a49600-222b-4866-80a0-37736ad29344,sh command-and-control,T1105,Ingress Tool Transfer,4,scp remote file copy (pull),b9d22b9a-9778-4426-abf0-568ea64e9c33,sh -command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,sh +command-and-control,T1105,Ingress Tool Transfer,5,sftp remote file copy (push),f564c297-7978-4aa9-b37a-d90477feea4e,bash command-and-control,T1105,Ingress Tool Transfer,6,sftp remote file copy (pull),0139dba1-f391-405e-a4f5-f3989f2c88ef,sh command-and-control,T1105,Ingress Tool Transfer,14,whois file download,c99a829f-0bb8-4187-b2c6-d47d1df74cab,sh command-and-control,T1105,Ingress Tool Transfer,31,File download via nscurl,5bcefe5f-3f30-4f1c-a61a-8d7db3f4450c,sh diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 3a918468..449e3d71 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -77971,7 +77971,7 @@ command-and-control: command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}'' ' - name: sh + name: bash - name: sftp remote file copy (pull) auto_generated_guid: '0139dba1-f391-405e-a4f5-f3989f2c88ef' description: 'Utilize sftp to perform a remote file copy (pull) diff --git a/atomics/Indexes/linux-index.yaml b/atomics/Indexes/linux-index.yaml index 64c57981..07b8573c 100644 --- a/atomics/Indexes/linux-index.yaml +++ b/atomics/Indexes/linux-index.yaml @@ -46050,7 +46050,7 @@ command-and-control: command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}'' ' - name: sh + name: bash - name: sftp remote file copy (pull) auto_generated_guid: '0139dba1-f391-405e-a4f5-f3989f2c88ef' description: 'Utilize sftp to perform a remote file copy (pull) diff --git a/atomics/Indexes/macos-index.yaml b/atomics/Indexes/macos-index.yaml index e3e935b1..689e24f2 100644 --- a/atomics/Indexes/macos-index.yaml +++ b/atomics/Indexes/macos-index.yaml @@ -43071,7 +43071,7 @@ command-and-control: command: 'sftp #{username}@#{remote_host}:#{remote_path} <<< $''put #{local_file}'' ' - name: sh + name: bash - name: sftp remote file copy (pull) auto_generated_guid: '0139dba1-f391-405e-a4f5-f3989f2c88ef' description: 'Utilize sftp to perform a remote file copy (pull) diff --git a/atomics/T1105/T1105.md b/atomics/T1105/T1105.md index 1c4d8fd2..02a2e13b 100644 --- a/atomics/T1105/T1105.md +++ b/atomics/T1105/T1105.md @@ -266,10 +266,10 @@ Utilize sftp to perform a remote file copy (push) | username | User account to authenticate on remote host | string | victim| -#### Attack Commands: Run with `sh`! +#### Attack Commands: Run with `bash`! -```sh +```bash sftp #{username}@#{remote_host}:#{remote_path} <<< $'put #{local_file}' ```