* feat: Adding atomic-red-team JSON Schema defintions
* feat: Adding validate.py script to validate all atomics against the defined schema
* feat: Adding validate-schema GitHub Workflow action to validate on every push to the repo
* ci: Updated the validate-schema workflow to support and use Ruby instead of python
* fix: Updated schema to remove schema draft version (not necessarily needed) and update to remove elevation_required as a required defined property
* fix: Removed the yaml schema version
* docs: Adding start of README
* fix: Adding an updated/better version of the python validation but may ultimately be removed
* feat: Adding Ruby version of validate.rb script
* fix: Removing files not needed since we are changing to github action and using the new validation code
* fix: Adding the yaml schema file back and removed the json version
* docs: Updated README with documentation
* fix: Updating schema to use new format validator
* fix: Updated validate.rb to verify that the Technique IDs are in the correct format.
* fix: Upating validate.rb to raise execptions so that failures flow up to the GitHub Action workflow
* fix: Updated all tests that have input_arguments not conformaing to schema defintion for type value of path
* fix: Updating the Validaton README for typos
* fixL: Minor updates to the schema
* minor schema changes
* github actions fix
* schema changes
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Co-authored-by: Hare Sudhan <code@0x6c.dev>
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* T1070.003-9 update (get_)prereq_commmand
- moved system changes to the get_prereq(s)
- ubuntu `passwd` didn't accept `--stdin`
- updated get_prereqs for both ubuntu/centos
* T1016 - update prereq
* T1018 - update prereq
* T1562.001 - update rsyslog prereq
* T1560.001 updates dep check/install, update default likely to exist
switch to /var/log/wtmp and /var/log/btmp vs ${HOME}/*.txt, since those will
always be present
tests for zip in the prereq
adds deb/rpm install for zip
* T1486 - update getprereqs
* T1135 - update prereqs
* T1046 - update prereqs
* T1040 - update prereqs
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
* Update T1040.yaml
Uses the built-in Windows packet capture
* Update T1040
Adding temp folder and del command to delete that trace.etl and added sleep command before and after (it does a little bit of processing when stopped) with PowerShell.
* Update T1040.yaml
Changed to use variables where possible (couldn't get %temp% to work in the command) Use a long time out (50 seconds) as it took awhile for collections to complete . Added more description to explain what artifacts are left after execution. Thanks Carrie with all your time/input spent on this to make it great.
* Update T1040.yaml
added %LOCALAPPDATA%
* Update T1040.yaml
Switched to %temp%
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Fix macOS tests
* Fix typo in T1574.006
* Replaced zsh with bash, add prereq_command
* Fix test name in T1053.004
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Windows' tests not running because of space in "Program Files". Added quotes to fix this. PowerShell not running exes by default. Added call operator (&) to force this.
chandangupta1997