Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Co-authored-by: Hare Sudhan <code@0x6c.dev>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* feat: Adding atomic-red-team JSON Schema defintions
* feat: Adding validate.py script to validate all atomics against the defined schema
* feat: Adding validate-schema GitHub Workflow action to validate on every push to the repo
* ci: Updated the validate-schema workflow to support and use Ruby instead of python
* fix: Updated schema to remove schema draft version (not necessarily needed) and update to remove elevation_required as a required defined property
* fix: Removed the yaml schema version
* docs: Adding start of README
* fix: Adding an updated/better version of the python validation but may ultimately be removed
* feat: Adding Ruby version of validate.rb script
* fix: Removing files not needed since we are changing to github action and using the new validation code
* fix: Adding the yaml schema file back and removed the json version
* docs: Updated README with documentation
* fix: Updating schema to use new format validator
* fix: Updated validate.rb to verify that the Technique IDs are in the correct format.
* fix: Upating validate.rb to raise execptions so that failures flow up to the GitHub Action workflow
* fix: Updated all tests that have input_arguments not conformaing to schema defintion for type value of path
* fix: Updating the Validaton README for typos
* fixL: Minor updates to the schema
* minor schema changes
* github actions fix
* schema changes
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Co-authored-by: Hare Sudhan <code@0x6c.dev>
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
* Update T1113.yaml
Added prereq commands to test 3 "X Windows Capture"
* Update T1113.yaml
errors with multi-line if statement. Condensed to one line
* Update T1113.yaml
Changed prereqs of test 3 to be the redhat default. Changed prereqs of test 3 to have more input arguments
* Update T1113.yaml
Fixed typo in descriptions.
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Update T1070.003.yaml
* Update T1078.001.yaml
* Update T1113.yaml
Remove error from screen when cleaning up for T1113-5
* Update T1197.yaml
Remove error when cleaning up for T1197-4
* Update T1562.001.yaml
Remove error from cleanup of T1562.001-23
* Update T1562.004.yaml
Remove error shown for cleanup of T15262.004-5 and T15262.004-6
* Update T1574.009.yaml
Remove error from cleanup of T1574.009-1
* Update T1553.004.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Update T1113.yaml
Update test #4 to include a prereq that downloads ImageMagik, updated test #4's name, and updated test #4's description.
* fix yaml spacing
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
* fixing yaml spacing issue
* correcting input name
* rm to del
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"
This reverts commit 511bb87af2.
* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* first draft at dependencies
* lowercase url
* removing descriptions of xxx (left over from template)
* update input param descriptions
* description update
* removing descriptions of xxx (left over from template)
Atomic Red Team doc generator