security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,538 Commits 47 Branches 0 Tags
pre-commit
Commit Graph

120 Commits

Author SHA1 Message Date
Atomic Red Team doc generator 5ede8f21e4 Generated docs from job=generate-docs branch=master [ci skip] 2025-02-13 22:03:40 +00:00
Atomic Red Team doc generator 4c6639f4ff Generated docs from job=generate-docs branch=master [ci skip] 2024-04-27 18:09:22 +00:00
NeuralGlitch e2428a7b12 Added new a new atomic test in T1003 and T1187 (#2758) 
* Update T1003.yaml

Added a new atomic test (number 7) - Send NTLM Hash with RPC Test Connection

* Update T1187.yaml

Added new atomic test under T1187 (Test no 3) - "Trigger an authenticated RPC call to a target server with no Sign flag set"

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-04-27 13:08:12 -05:00
Atomic Red Team doc generator f64434da24 Generated docs from job=generate-docs branch=master [ci skip] 2024-04-27 17:50:49 +00:00
Atomic Red Team doc generator 81692e20cd Generated docs from job=generate-docs branch=master [ci skip] 2023-09-23 03:44:15 +00:00
Carrie Roberts fc3bfecda2 use ExternalPayloads folder (#2538) 2023-09-22 23:43:06 -04:00
Atomic Red Team doc generator a228ee8656 Generated docs from job=generate-docs branch=master [ci skip] 2023-09-22 19:15:21 +00:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Atomic Red Team doc generator 868f5477f6 Generated docs from job=generate-docs branch=master [ci skip] 2023-06-15 19:53:19 +00:00
Carrie Roberts 586818a01f use ExternalPayloads folder (#2462) 
* use ExternalPayloads folder

* psexec as external dependency

* psexec as external dependency
 2023-06-15 13:52:16 -06:00
Atomic Red Team doc generator 199dd7f85d Generated docs from job=generate-docs branch=master [ci skip] 2023-06-14 20:25:05 +00:00
Carrie Roberts 3e4e817aa4 Add ExternalPayloads folder for downloaded prerequisites (#2459) 
* use ExternalPayloads folder for prereqs

* git ignore ExternalPayloads folder

* move External folder up one directory
 2023-06-14 14:24:03 -06:00
Atomic Red Team doc generator 16594d72c5 Generated docs from job=generate-docs branch=master [ci skip] 2023-02-13 23:11:19 +00:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Atomic Red Team doc generator ce55c6dfb1 Generated docs from job=generate-docs branch=master [ci skip] 2022-11-29 00:09:43 +00:00
Atomic Red Team GUID generator 747a28a689 Generate GUIDs from job=generate-docs branch=master [skip ci] 2022-11-29 00:09:36 +00:00
tr4cefl0w d4721d481c adding credman gump using keymgr.dll (#2242) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-11-28 19:09:04 -05:00
Atomic Red Team doc generator 55d2311eeb Generated docs from job=generate-docs branch=master [ci skip] 2022-11-07 21:21:50 +00:00
BlueTeamOps 83ca10639b Update T1003 (#2225) 
* Added AppCmd list command

AppCmd list command can be used to retrieve IIS service account credentials.

* Update - Test name update and a new test

Updated the test name of 6c7a4fd3-5b0b-4b30-a93e-39411b25d889
Added a new test to simulate /config command for AppCmd
 2022-11-07 14:21:05 -07:00
Atomic Red Team doc generator 17b4c931b6 Generated docs from job=generate-docs branch=master [ci skip] 2022-11-07 14:39:00 +00:00
BlueTeamOps ae01b90e1f Added AppCmd list command (#2224) 
AppCmd list command can be used to retrieve IIS service account credentials.
 2022-11-07 07:38:16 -07:00
Atomic Red Team doc generator ebfc28708d Generated docs from job=generate-docs branch=master [ci skip] 2022-05-17 22:48:32 +00:00
Carrie Roberts c171910f63 typo fix (#1973) 2022-05-17 16:48:04 -06:00
CircleCI Atomic Red Team doc generator 4c36b9b772 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-12-30 19:08:33 +00:00
MrOrOneEquals1 e0f2a76114 Update T1003.yaml (#1702) 
* Update T1003.yaml

Add -UseBasicParsing to line 41

* Update T1003.yaml

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-12-30 12:08:06 -07:00
CircleCI Atomic Red Team doc generator bc21f59ff0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-04 00:21:31 +00:00
Josh Rickard 1513717eb2 Updating atomics to conform to standard (#1619) 
* Updated format of input_argument types for Url

* Updated type for input_arguments to Url (missed)

* Updating Path type for input_arguments

* Updated String type for input_arguments

* Missed a few Strings and Url types

* Updated default values for input_arguments to align with their types

* Updated Integer type for input_arguments

* Updated formatting and spacing of atomics
 2021-09-03 18:20:46 -06:00
CircleCI Atomic Red Team doc generator 4af8bae9f4 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-14 17:14:29 +00:00
CircleCI Atomic Red Team GUID generator 1f82f6af1f Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-14 17:14:23 +00:00
Jay_darknight d42bda32a1 Dump svchost.exe to gather RDP plaintext credential (#1551) 2021-07-14 11:13:59 -06:00
CircleCI Atomic Red Team doc generator 36d49de4c8 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 17:04:33 +00:00
CircleCI Atomic Red Team doc generator 575b36a8e6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 15:16:54 +00:00
CircleCI Atomic Red Team doc generator 88ad3fd322 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-16 18:41:22 +00:00
SecurityShrimp 42799b033d added TLS/SSL v1.2 enabling commands to any atomic test utilizing IWR (#1519) 
* Update T1204.002.md

Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with 

```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12```

* Update T1555.yaml

added line to set ssl/tls version

* Update T1134.001.yaml

updated IWR lines to allow ssl/tls version 1.2

* Update T1069.002.yaml

added lines to every IWR instance to set ssl/tls version to 1.2

* Update T1558.003.yaml

added line to allow TLS/SSL 1.2

* Update T1033.yaml

added command to enable SSL/TLS v1.2

* Update T1055.012.yaml

added command to enable TLS/SSL v1.2

* Update T1115.yaml

Added command to enable SSL/TLS v1.2

* Update T1070.001.yaml

added command enabling SSL/TLS v 1.2

* Update T1564.yaml

added commands to enable SSL/TLS v 1.2

* Update T1566.001.yaml

added command to enable SSL/TLS V1.2

* Update T1135.yaml

added command to enable SSL/TLS v1.2

* Update T1055.yaml

added commands to enable TLS/SSL v 1.2

* Update T1110.003.yaml

added command to enable TLS/SSL v1.2

* Update T1003.yaml

Added command to enable TLS/SSL v1.2

* Update T1053.005.yaml

added command to enable TLS/SSL v1.2

* Update T1003.001.yaml

added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest

* Update T1069.002.yaml

syntax correction

* Update T1134.001.yaml

syntax correction

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-06-16 12:41:04 -06:00
CircleCI Atomic Red Team doc generator 058b5c2423 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-03-22 15:39:07 +00:00
Matt Graeber 92026b8e3c Moving Invoke-Mimikatz test to T1003.001 (#1407) 2021-03-22 09:38:35 -06:00
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator 04a409832e Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-20 20:40:34 +00:00
Geoff Galitz f7584be904 T1003 NPPSPY GetPrereqs location fix (#1202) 
* Before:  NPPSPY is installed into atomics src directories, test
looks for it in the local temp directory resulting in an error.

After: Test is changed to look for NPPSPY directly in atomics src
directory

* Change test to install prereq to local temp directory and work from
there.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-08-20 14:40:09 -06:00
CircleCI Atomic Red Team doc generator 99a4e8850a Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-07 17:14:19 +00:00
CircleCI Atomic Red Team doc generator 6165e9e71d Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-05 00:38:43 +00:00
CircleCI Atomic Red Team doc generator a001d93114 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 23:42:37 +00:00
Danil Karandin 139386e8bd T1003 Creds Dumping with NPPSpy (#1149) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-20 17:41:47 -06:00
CircleCI Atomic Red Team doc generator f3799322c7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-14 14:51:13 +00:00
Scoubi f5665eafea Update T1003.yaml (#1120) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-14 08:50:50 -06:00
CircleCI Atomic Red Team doc generator 8a82e9b66a Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-18 01:57:35 +00:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056) 
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
Michael Haag cbe842b8d8 T1003 pwcollector (#989) 
* T1003 - Chrome Password Collector

* Generate docs from job=validate_atomics_generate_docs branch=T1003-Pwcollector

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-05-14 16:48:14 -06:00
CircleCI Atomic Red Team doc generator 84cad45461 Generate docs from job=validate_atomics_generate_docs branch=master 2020-04-01 14:47:35 +00:00