* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Updated Descriptions
Updated descriptions with what to expect from successful execution.
* Update T1028.yaml
* Update T1028.yaml
* Generate docs from job=validate_atomics_generate_docs branch=description-updates
* move text to description
* Generate docs from job=validate_atomics_generate_docs branch=description-updates
* typo fix
* Generate docs from job=validate_atomics_generate_docs branch=description-updates
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
* fixing yaml spacing issue
* correcting input name
* rm to del
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"
This reverts commit 511bb87af2.
* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
Changing default value from env:SystemRoot to env:Temp. By default, user can write to systemroot temp directory but cannot execute the cleanup commands. Correcting typo scvhost to svchost.
* Adding T1086 Alternate Data Stream atomic
* Added newline T1086
* Syncing changes with updstream and origin.
* Added Cleanup to Logon Scripts Atomic T1037
* Added timout to allow time for detection logic to register change.
* Fixed issue with upstream sync, Re-added timout to allow time for detection logic.
* Fixed cleanup command. Yaml tag not working to allow it to run.
* Update T1158 test 11.
Corrected ADS syntax. Added loop to run embedded ADS command from shell. Also added cleanup code.
* Update T1037.yaml
Moved Reg delete command under the cleanup_command tag for consistency.
* Update T1037.yaml
Moved reg removal command under cleanup_command tag for consistency.
* Update T1086.yaml
Bug Fix: Updated Base64 encoded command in T1086-12 with correct syntax and environment variables for power shell compatibility (was for cmd.exe only). Original decoded payload referenced %SystemRoot%, whereas PowerShell uses $env:SystemRoot. Also replaced single quotes with double quotes to prevent PowerShell from interpreting it as a literal string.
Enhancement: Added Cleanup_commands for T1086-12. Added comments for what the Base64 encoded payload is.
* Update T1036.yaml
Added Cleanup commands for the windows tests
Atomic Red Team doc generator