Commit Graph

105 Commits

Author SHA1 Message Date
CircleCI Atomic Red Team doc generator 603040c6e3 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-01-06 18:42:39 +00:00
Clément Notin b0a0bbc66e T1055: add new test "Remote Process Injection in LSASS via mimikatz" (#1353)
Co-authored-by: Zakaria Addi <zakaria.addi@alsid.com>
Co-authored-by: Clément Notin <clement.notin@alsid.com>

Co-authored-by: Zakaria Addi <zakaria.addi@alsid.com>
2021-01-06 11:42:08 -07:00
Keith McCammon 28086402e2 Maintainers updates (#1328)
* Update maintainers.md

Remove reference to announcements channel, which has been created.

* Generate docs from job=validate_atomics_generate_docs branch=maintainers-updates

* Update maintainers.md

Updates to maintainers meeting purpose, scope, and agendas.

* Generate docs from job=validate_atomics_generate_docs branch=maintainers-updates

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-12-15 14:18:41 -07:00
Ama Smuggle Avocados 9e352ddc2d Shellcodevba (#1326)
* initial push for T1055 (Shellcode execution via VBA)

* updates

* updates

* updates

Co-authored-by: avocado <avocados@smuggler.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-12-11 07:55:17 -07:00
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator 2435846063 Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-29 22:46:36 +00:00
Clément Notin d7f38267d5 T1055: tech 1, launch visible notepad (#1035)
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-06-29 16:46:15 -06:00
CircleCI Atomic Red Team doc generator 8a82e9b66a Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-18 01:57:35 +00:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056)
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator be41a50f01 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-21 22:27:49 +00:00
Brian Thacker 2cc548c118 Fix typo t1055 t1100 t1010 (#1007)
* Path correction test 4

T1055 test 4 default path of exe_binary did not work on a standard system nor provide the flexibility of an input argument.

* Update T1100.yaml

Added /q (quiet mode) to the cleanup command to prevent command from hanging.

* Update T1010.yaml

Test 1 used a default path with an environment variable naming schema used with powershell not the executor command_prompt.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-05-21 16:27:29 -06:00
CircleCI Atomic Red Team doc generator f1cc467b21 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-20 15:58:43 +00:00
Andrew Beers f8cd169ca3 Move test to T1105 (#1000) 2020-05-20 09:58:20 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
CircleCI Atomic Red Team doc generator f3e095dee9 Generate docs from job=validate_atomics_generate_docs branch=master 2020-04-28 17:04:21 +00:00
hypnoticpattern 57197a9a6f T1009, T1014, T1055, T1215: Added dependencies (#958)
Co-authored-by: hypnoticpattern <>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-04-28 11:03:53 -06:00
CircleCI Atomic Red Team doc generator fb702afdef Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-23 20:57:21 +00:00
Andrew Beers 1e601b4b9c Fix description, remove broken test (#904)
* start work

* fix test to run 64 bit version

* delete broken test

* fix merge conflicts

* merge

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-03-23 14:56:18 -06:00
Michael Haag ab0b391ac0 Updated Descriptions (#899)
* Updated Descriptions

Batch of description updates to assist with understand what a test will do.

* Update T1055.yaml

* Update T1055.yaml

Trying to fix this...

* Update T1055.yaml

fixing again

* Update T1055.yaml

* spacing fix

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

* wording updates

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

* remove cmd.exe /c prefix

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

* wording update

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

* add back tick

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

* hashtag stuff

* Generate docs from job=validate_atomics_generate_docs branch=descriptions

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
2020-03-20 16:48:58 -06:00
CircleCI Atomic Red Team doc generator f1bcfda48a Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-16 21:33:02 +00:00
Matt Graeber c6788c5736 Atomic test bug fixes/consistency improvements (#884)
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-03-16 15:32:25 -06:00
Carrie Roberts 71223b2514 backslash fix for markdown (#881) 2020-03-16 08:50:43 -06:00
Carrie Roberts 6ec7d4bcf0 Specify language for markdown code blocks (#882)
* specify code block type in markdown

* specify code block type in markdown
2020-03-16 08:46:25 -06:00
CircleCI Atomic Red Team doc generator 2f778f359e Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-10 23:06:25 +00:00
JrOrOneEquals1 3fa4dd1c9e Fixed cleanup commands (#869)
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-03-10 17:06:14 -06:00
CircleCI Atomic Red Team doc generator cdb4000e20 Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-10 23:03:32 +00:00
JrOrOneEquals1 c6d8809af3 Add prereqs (#867)
* Added prereqs

* Added prereqs

* Add prereqs

* undeleting file

* corrections

* Corrections
2020-03-10 17:02:52 -06:00
Tony M Lambert a4c9ee4430 Replay the Dependencies Merge (#786)
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* fixing yaml spacing issue

* correcting input name

* rm to del

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-01-21 12:11:45 -06:00
Tony M Lambert c3b398e48c Revert "Add Dependencies section to test Yaml and support to use them… (#773)
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"

This reverts commit 511bb87af2.

* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
2020-01-09 09:12:38 -06:00
Carrie Roberts 511bb87af2 Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url
2020-01-09 07:36:07 -07:00
CircleCI Atomic Red Team doc generator ddadfbb3bf Generate docs from job=validate_atomics_generate_docs branch=master 2019-11-14 22:57:31 +00:00
Brandon Morgan e93ed496ac default pid set to spoolsv (#656) 2019-11-14 15:57:07 -07:00
CircleCI Atomic Red Team doc generator 31cb175475 Generate docs from job=validate_atomics_generate_docs branch=master 2019-11-08 17:47:02 +00:00
Carrie Roberts c648b94ff1 remove hard-coded path to atomics foler in tests (#618) 2019-11-08 11:46:46 -06:00
CircleCI Atomic Red Team doc generator 43683f44af Generate docs from job=validate_atomics_generate_docs branch=master 2019-11-07 22:28:26 +00:00
Andrew Beers cb5f6c91a6 T1055 svchost writing a file to a unc path (#615)
* add test

* delete fake svchost

* Update atomics/T1055/T1055.yaml

Co-Authored-By: Keith McCammon <keith@mccammon.org>

* Update atomics/T1055/T1055.yaml

Co-Authored-By: Keith McCammon <keith@mccammon.org>
2019-11-07 15:27:56 -07:00
CircleCI Atomic Red Team doc generator 5b8e894e61 Generate docs from job=validate_atomics_generate_docs branch=master 2019-11-05 19:01:25 +00:00
Tony M Lambert 6cf9c681fd T1055 Test for LD_PRELOAD (#601)
* T1055 Test for LD_PRELOAD

* Update T1055.yaml
2019-11-05 12:00:58 -07:00
CircleCI Atomic Red Team doc generator 4fb62d4875 Generate docs from job=validate_atomics_generate_docs branch=master 2019-10-16 18:16:43 +00:00
Carrie Roberts e206885e1d naming variable correctly so it gets replaced as a variable at execution time (#588) 2019-10-16 12:16:19 -06:00
CircleCI Atomic Red Team doc generator 499c751bcc Generate docs from job=validate_atomics_generate_docs branch=master 2019-09-03 13:36:10 +00:00
CircleCI Atomic Red Team doc generator d8ac1118b3 Generate docs from job=validate_atomics_generate_docs branch=master 2019-09-03 13:34:56 +00:00
Carrie Roberts 1bfefdacfc Add elevated (#542)
* provide elevation_required attribute

* provide elevation_required attribute

* provide elevation_required attribute
2019-09-03 07:34:42 -06:00
CircleCI Atomic Red Team doc generator 440e85a9c8 Generate docs from job=validate_atomics_generate_docs branch=master 2019-08-30 15:42:59 +00:00
CircleCI Atomic Red Team doc generator 75c332ac52 Generate docs from job=validate_atomics_generate_docs branch=master 2019-08-29 22:18:28 +00:00
caseysmithrc a668ff07d9 T1055 process injection (#460)
* ProcessInjection-FiveAlive

* Generate docs from job=validate_atomics_generate_docs branch=T1055-ProcessInjection
2019-02-17 14:45:00 -08:00
CircleCI Atomic Red Team doc generator c7142a4487 Generate docs from job=validate_atomics_generate_docs branch=master 2019-02-05 21:05:23 +00:00
Tony M Lambert b831127ab2 T1055 - Test for shared library injection on Linux (#448)
* initial commit

* modified output style

* final url changes

* Update rocke-and-roll-stage-01.sh

* T1055 - Added test for /etc/ld.so.preload addition
2019-02-05 13:05:15 -08:00
CircleCI Atomic Red Team doc generator 6965fc15ef Generate docs from job=validate_atomics_generate_docs branch=master 2018-11-14 20:59:18 +00:00
caseysmithrc bd4afde020 T1055 update (#370)
* Correct T1055 Soruce and Test

* Generate docs from job=validate_atomics_generate_docs branch=T1055-Update

* Update T1055.cpp
2018-10-04 19:02:30 -07:00