security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,616 Commits 47 Branches 0 Tags
master
Commit Graph

63 Commits

Author SHA1 Message Date
Atomic Red Team doc generator 9f6a1eab36 Generated docs from job=generate-docs branch=master [ci skip] 2026-02-18 16:55:45 +00:00
Atomic Red Team doc generator 376bf2a64d Generated docs from job=generate-docs branch=master [ci skip] 2026-02-18 16:46:29 +00:00
Atomic Red Team doc generator 5ede8f21e4 Generated docs from job=generate-docs branch=master [ci skip] 2025-02-13 22:03:40 +00:00
Atomic Red Team doc generator 501dd6c05e Generated docs from job=generate-docs branch=master [ci skip] 2024-11-20 01:35:37 +00:00
Atomic Red Team doc generator 8218baac09 Generated docs from job=generate-docs branch=master [ci skip] 2024-10-04 21:11:16 +00:00
Br3akp0int 062948f44f Uac bypassed and persistence (#2939) 
* ShrinkLocker PIN,TPM Bitlocker Registry Modification

* Revert "ShrinkLocker PIN,TPM Bitlocker Registry Modification"

* UAC and persistence - T1053.005.yaml

UAC and persistence

* Update T1053.005.yaml

adding atomic back in

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-10-04 15:10:23 -06:00
Atomic Red Team doc generator e851100c42 Generated docs from job=generate-docs branch=master [ci skip] 2024-09-24 15:22:14 +00:00
Michael Haag 4034c339d5 CompMgmt.msc (#2937) 
msc to shell

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-09-24 10:21:20 -05:00
Atomic Red Team doc generator da6a0516db Generated docs from job=generate-docs branch=master [ci skip] 2023-11-08 00:29:16 +00:00
Atomic Red Team GUID generator 717f5941fd Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-11-08 00:28:55 +00:00
Micah Babinski dfb25a02e3 Add Test for Registry-Only "Ghost Tasks" Procedure within T1053.005 (#2588) 
* Added ghost task test

* Minor improvements to documentation and test design.

---------

Co-authored-by: Hare Sudhan <code@0x6c.dev>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-11-07 19:28:14 -05:00
Atomic Red Team doc generator a228ee8656 Generated docs from job=generate-docs branch=master [ci skip] 2023-09-22 19:15:21 +00:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Atomic Red Team doc generator b1f3c968f2 Generated docs from job=generate-docs branch=master [ci skip] 2023-05-19 17:06:33 +00:00
Atomic Red Team doc generator 16594d72c5 Generated docs from job=generate-docs branch=master [ci skip] 2023-02-13 23:11:19 +00:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Atomic Red Team doc generator 690097dc5d Generated docs from job=generate-docs branch=master [ci skip] 2023-01-12 15:41:02 +00:00
Carrie Roberts 421ef67baf fix cleanup key 2023-01-12 09:55:38 -05:00
CDub1016 c093205999 Update T1053.005.yaml (#2276) 
* Update T1053.005.yaml

Created cleanup command for T1053.005-Task Scheduler via VBA-Cleanup commands created

* Update T1053.005.yaml

Fixed syntax error.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-01-10 16:41:32 -07:00
Atomic Red Team doc generator d0dad62dbc Generated docs from job=generate-docs branch=master [ci skip] 2022-09-23 22:57:18 +00:00
Atomic Red Team doc generator dac55eca04 Generated docs from job=generate-docs branch=master [ci skip] 2022-09-23 17:30:46 +00:00
tlor89 f24823b04f T1053.005_update (#2155) 
* T1053.005_update

* Update T1053.005.yaml

Co-authored-by: Toua Lor <tlor@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-09-23 11:30:15 -06:00
Atomic Red Team doc generator 6e0b2c9b33 Generated docs from job=generate-docs branch=master [ci skip] 2022-09-07 02:36:33 +00:00
Carrie Roberts efe7d48f59 typo fix (#2120) 2022-09-06 20:36:00 -06:00
Atomic Red Team doc generator d8c6b653b4 Generated docs from job=generate-docs branch=master [ci skip] 2022-08-17 21:30:09 +00:00
Atomic Red Team GUID generator bf0c945de8 Generate GUIDs from job=generate-docs branch=master [skip ci] 2022-08-17 21:30:01 +00:00
Michael Haag a93030e394 Linux and Windows (#2085) 
* Linux and Windows

* Update T1115.yaml
 2022-08-17 15:29:33 -06:00
Atomic Red Team doc generator 819934cc3f Generated docs from job=generate-docs branch=master [ci skip] 2022-06-16 22:47:00 +00:00
Atomic Red Team doc generator 5a14d96c37 Generated docs from job=generate-docs branch=master [ci skip] 2022-06-15 21:35:21 +00:00
tccontre a768529778 Creates Schedule task with hidden attribute settings (#1986) 
* Update T1112.yaml

* Update T1112.yaml

* typos

* Update T1087.002.yaml

* Update T1087.002.yaml

* Update T1087.002.yaml

* Add files via upload

* Update T1053_05_SCTASK_HIDDEN_ATTRIB.xml

* Update T1053.005.yaml

* Update T1053.005.yaml

* Update T1087.002.yaml

* Update T1087.002.yaml

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-06-03 18:03:49 -06:00
CircleCI Atomic Red Team doc generator ba46d54c29 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-04-07 15:40:23 +00:00
NoL1mit 9c4cb3a099 Surround time variable in single quotes (#1855) 
* Surround time variable in single quotes

The time in the YAML file should be wrapped in single quotes due to the colon being interpreted to have special meaning.

* Update T1053.005.yaml

Fixed parameters versus command logic
 2022-04-07 09:39:55 -06:00
CircleCI Atomic Red Team doc generator 0e616b34b3 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-03-02 22:00:09 +00:00
CircleCI Atomic Red Team GUID generator 28e7237bc1 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-03-02 22:00:03 +00:00
SecWilson b62ba2e548 Atomic that mimics recent Qakbot behavior (#1793) 
* Atomic that mimics recent Qakbot behavior

* small edits

removed elevation_required, shortened test name, made some readability updates.

Co-authored-by: Wilson <SWilson@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-03-02 14:59:28 -07:00
CircleCI Atomic Red Team doc generator bc21f59ff0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-04 00:21:31 +00:00
Josh Rickard 1513717eb2 Updating atomics to conform to standard (#1619) 
* Updated format of input_argument types for Url

* Updated type for input_arguments to Url (missed)

* Updating Path type for input_arguments

* Updated String type for input_arguments

* Missed a few Strings and Url types

* Updated default values for input_arguments to align with their types

* Updated Integer type for input_arguments

* Updated formatting and spacing of atomics
 2021-09-03 18:20:46 -06:00
CircleCI Atomic Red Team doc generator c5d92e8cc0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-30 23:00:49 +00:00
Carrie Roberts 9bf1327611 fix cleanup command (#1575) 2021-07-30 17:00:00 -06:00
CircleCI Atomic Red Team doc generator 1e024d99ea Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-02 12:38:23 +00:00
Carrie Roberts c0e5117730 moving invoke-maldoc into art repo 2021-07-01 20:11:10 -06:00
CircleCI Atomic Red Team doc generator 36d49de4c8 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 17:04:33 +00:00
CircleCI Atomic Red Team doc generator 575b36a8e6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 15:16:54 +00:00
CircleCI Atomic Red Team doc generator 88ad3fd322 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-16 18:41:22 +00:00
SecurityShrimp 42799b033d added TLS/SSL v1.2 enabling commands to any atomic test utilizing IWR (#1519) 
* Update T1204.002.md

Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with 

```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12```

* Update T1555.yaml

added line to set ssl/tls version

* Update T1134.001.yaml

updated IWR lines to allow ssl/tls version 1.2

* Update T1069.002.yaml

added lines to every IWR instance to set ssl/tls version to 1.2

* Update T1558.003.yaml

added line to allow TLS/SSL 1.2

* Update T1033.yaml

added command to enable SSL/TLS v1.2

* Update T1055.012.yaml

added command to enable TLS/SSL v1.2

* Update T1115.yaml

Added command to enable SSL/TLS v1.2

* Update T1070.001.yaml

added command enabling SSL/TLS v 1.2

* Update T1564.yaml

added commands to enable SSL/TLS v 1.2

* Update T1566.001.yaml

added command to enable SSL/TLS V1.2

* Update T1135.yaml

added command to enable SSL/TLS v1.2

* Update T1055.yaml

added commands to enable TLS/SSL v 1.2

* Update T1110.003.yaml

added command to enable TLS/SSL v1.2

* Update T1003.yaml

Added command to enable TLS/SSL v1.2

* Update T1053.005.yaml

added command to enable TLS/SSL v1.2

* Update T1003.001.yaml

added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest

* Update T1069.002.yaml

syntax correction

* Update T1134.001.yaml

syntax correction

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-06-16 12:41:04 -06:00
CircleCI Atomic Red Team doc generator 5dd066ec61 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-30 20:50:27 +00:00
CircleCI Atomic Red Team GUID generator 50f1ea7a06 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-30 20:50:22 +00:00
Ján Trenčanský 731a7c9ed6 T1053.005 create SchduledTask using WMI class (#1434) 
* ScheduledTask via WMI

* Fix typos and XML load

* Fix wrong cmdlet name in test name

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-04-30 14:49:42 -06:00
CircleCI Atomic Red Team doc generator 228dcb1ae3 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-02 13:28:54 +00:00
Carrie Roberts 8b6c9af427 add usebasicparsing flag (#1410) 2021-04-02 07:28:29 -06:00