security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,538 Commits 47 Branches 0 Tags
python_conversion
Commit Graph

105 Commits

Author SHA1 Message Date
Atomic Red Team doc generator 5ede8f21e4 Generated docs from job=generate-docs branch=master [ci skip] 2025-02-13 22:03:40 +00:00
Atomic Red Team doc generator 98f9300887 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-08 21:39:53 +00:00
Thomas M f92569597a Add new atomic test T1055 custom uuid process injection in C, a stealthier implementation compares to the original one introduced by NCC group (#2674) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-08 15:39:08 -06:00
Atomic Red Team doc generator d8b3cefbdb Generated docs from job=generate-docs branch=master [ci skip] 2023-12-01 21:29:03 +00:00
Atomic Red Team GUID generator 5c63f2082e Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-12-01 21:28:45 +00:00
navsec 6879f4e317 Add tests for various shellcode running techniques using Go (#2627) 
* Adding shellcode running techniques using Go

* Removing auto-generated guid before PR

---------

Co-authored-by: navsec <navsec@navsec.net>
 2023-12-01 15:27:51 -06:00
Atomic Red Team doc generator cfb9321b8d Generated docs from job=generate-docs branch=master [ci skip] 2023-11-17 17:29:19 +00:00
Atomic Red Team GUID generator e76abe6a90 Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-11-17 17:28:59 +00:00
Hare Sudhan 2f26d9917a Duplicate guid fix (#2609) 
* duplicate guid fix

* duplicate guid fix
 2023-11-17 09:28:12 -08:00
Atomic Red Team doc generator 323c12d348 Generated docs from job=generate-docs branch=master [ci skip] 2023-11-07 22:02:39 +00:00
Thomas Meng d133634d49 Process injection RWX injection / Mockingjay local injection (#2587) 
* This should be a short message describing what changed.

* The new process injection technique: RWX injection AKA Mockingjay under T1055

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-11-07 14:01:21 -08:00
Atomic Red Team doc generator a228ee8656 Generated docs from job=generate-docs branch=master [ci skip] 2023-09-22 19:15:21 +00:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Atomic Red Team doc generator 4624b2c995 Generated docs from job=generate-docs branch=master [ci skip] 2023-09-12 02:52:27 +00:00
Atomic Red Team GUID generator a68b2cfabe Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-09-12 02:52:08 +00:00
art-labs 0c57c49f1b Update T1055.yaml (#2526) 
removing invalid guid. a new one will be automatically assigned by github actions
 2023-09-11 20:51:30 -06:00
Thomas Meng 886ede1606 Process injection dirty vanity (#2520) 
* Add new T1055 process injection test named dirty vanity

* Fix typos

* Update build.bat

* Delete atomics/T1055/T1055.yaml.bak

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-09-06 12:28:11 -06:00
Atomic Red Team doc generator cef46e4479 Generated docs from job=generate-docs branch=master [ci skip] 2023-06-15 16:17:12 +00:00
Carrie Roberts 068d32b1ea use ExternalPayloads directory (#2460) 
* use ExternalPayloads directory

* use ExternalPayloads directory

* use ExternalPayloads directory
 2023-06-15 10:16:12 -06:00
Atomic Red Team doc generator b1f3c968f2 Generated docs from job=generate-docs branch=master [ci skip] 2023-05-19 17:06:33 +00:00
Carrie Roberts a568b296ee add -UseBasicParsing (#2405) 
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
 2023-04-27 09:14:01 -06:00
Atomic Red Team doc generator 16594d72c5 Generated docs from job=generate-docs branch=master [ci skip] 2023-02-13 23:11:19 +00:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Atomic Red Team doc generator c4c81934d2 Generated docs from job=generate-docs branch=master [ci skip] 2023-01-10 23:37:09 +00:00
Atomic Red Team GUID generator 7eb64678b5 Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-01-10 23:37:01 +00:00
tr4cefl0w 43a42402af adding Section View injection (#2275) 2023-01-10 16:36:25 -07:00
Atomic Red Team doc generator c3788b083e Generated docs from job=generate-docs branch=master [ci skip] 2022-10-04 22:33:31 +00:00
tlor89 cf8cae7466 T1055 (#2177) 
* T1055

* Update input args description

Co-authored-by: Toua Lor <tlor@nti.local>
 2022-10-04 16:33:02 -06:00
Atomic Red Team doc generator 09bc35dea1 Generated docs from job=generate-docs branch=master [ci skip] 2022-09-26 17:40:43 +00:00
Carrie Roberts 869f7e880d mimi prereq fixes (#2163) 
* mimi prereq fixes

* fix url to helper
 2022-09-26 11:40:00 -06:00
CircleCI Atomic Red Team doc generator bc21f59ff0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-04 00:21:31 +00:00
Josh Rickard 1513717eb2 Updating atomics to conform to standard (#1619) 
* Updated format of input_argument types for Url

* Updated type for input_arguments to Url (missed)

* Updating Path type for input_arguments

* Updated String type for input_arguments

* Missed a few Strings and Url types

* Updated default values for input_arguments to align with their types

* Updated Integer type for input_arguments

* Updated formatting and spacing of atomics
 2021-09-03 18:20:46 -06:00
CircleCI Atomic Red Team doc generator b10fa043d1 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-08-23 21:09:34 +00:00
Arioch 50e36cb7e7 Update hardcoded Mimikatz releases download URLs (#1604) 
* update references to hardcoded mimikatz releases

* update invoke-webreauest parameters

* apply -UseBasicParsing consistently to Invoke-WebRequest calls

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-08-23 15:08:54 -06:00
CircleCI Atomic Red Team doc generator 7110df3098 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-08-18 21:27:57 +00:00
Arioch 5ea85dab6d T1055-2: update mimikatz download url (#1602) 
* update mimikatz download url

* fix minor typo

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-08-18 15:27:26 -06:00
CircleCI Atomic Red Team doc generator 6f40c444af Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-07 17:38:50 +00:00
Clément Notin 1a4c4a97d2 Improve discoverability of "Active Directory" attacks (#1544) 2021-07-07 11:38:22 -06:00
CircleCI Atomic Red Team doc generator 1e024d99ea Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-07-02 12:38:23 +00:00
Carrie Roberts c0e5117730 moving invoke-maldoc into art repo 2021-07-01 20:11:10 -06:00
CircleCI Atomic Red Team doc generator 36d49de4c8 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 17:04:33 +00:00
CircleCI Atomic Red Team doc generator 575b36a8e6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 15:16:54 +00:00
CircleCI Atomic Red Team doc generator 88ad3fd322 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-16 18:41:22 +00:00
SecurityShrimp 42799b033d added TLS/SSL v1.2 enabling commands to any atomic test utilizing IWR (#1519) 
* Update T1204.002.md

Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with 

```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12```

* Update T1555.yaml

added line to set ssl/tls version

* Update T1134.001.yaml

updated IWR lines to allow ssl/tls version 1.2

* Update T1069.002.yaml

added lines to every IWR instance to set ssl/tls version to 1.2

* Update T1558.003.yaml

added line to allow TLS/SSL 1.2

* Update T1033.yaml

added command to enable SSL/TLS v1.2

* Update T1055.012.yaml

added command to enable TLS/SSL v1.2

* Update T1115.yaml

Added command to enable SSL/TLS v1.2

* Update T1070.001.yaml

added command enabling SSL/TLS v 1.2

* Update T1564.yaml

added commands to enable SSL/TLS v 1.2

* Update T1566.001.yaml

added command to enable SSL/TLS V1.2

* Update T1135.yaml

added command to enable SSL/TLS v1.2

* Update T1055.yaml

added commands to enable TLS/SSL v 1.2

* Update T1110.003.yaml

added command to enable TLS/SSL v1.2

* Update T1003.yaml

Added command to enable TLS/SSL v1.2

* Update T1053.005.yaml

added command to enable TLS/SSL v1.2

* Update T1003.001.yaml

added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest

* Update T1069.002.yaml

syntax correction

* Update T1134.001.yaml

syntax correction

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-06-16 12:41:04 -06:00
CircleCI Atomic Red Team doc generator 228dcb1ae3 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-02 13:28:54 +00:00
Carrie Roberts 8b6c9af427 add usebasicparsing flag (#1410) 2021-04-02 07:28:29 -06:00
CircleCI Atomic Red Team doc generator 396ea73b70 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-03-13 14:24:38 +00:00
Matt Graeber 80415a586f Moving mavinject test to T1055.001 and src cleanup #1404 (#1405) 
* Moving mavinject test to T1055.001 and src cleanup #1404

* Adding Windows Command Prompt test

* Adding rundll32.exe test

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-03-13 07:22:36 -07:00
CircleCI Atomic Red Team doc generator 974e2eb8b6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-03-10 04:09:43 +00:00
Clément Notin 2221b0715b T1055: psexec "-s" is not required (#1402) 
Since the user is admin the debug privilege is automatically obtained when necessary for the injection
The TTP is also clearer because mimikatz runs as the current user (used for psexec) and not as SYSTEM
 2021-03-09 21:09:09 -07:00