security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,538 Commits 47 Branches 0 Tags
python_conversion
Commit Graph

37 Commits

Author SHA1 Message Date
za 6cb8a46876 Fix typo on T1098.md (#2993) 2024-12-11 11:34:41 -07:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Atomic Red Team GUID generator a5741ecb8f Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-06-23 22:43:25 +00:00
Hare Sudhan f10b65a2ea add terraform files for T1098-17 2023-06-22 21:21:40 -04:00
Hare Sudhan 63a994cf86 fix terraform; move gcloud login to deps 2023-06-22 20:34:28 -04:00
Paul 3c8f4a40f0 Add GCP Atomics 
Created 4 GCP-based atomics
 2023-06-09 09:43:12 -07:00
Carrie Roberts 0665611356 elevation not required for password changes 2023-05-26 19:04:02 -06:00
Atomic Red Team GUID generator bafcc36958 Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-05-26 20:46:01 +00:00
Carrie Roberts a62d04d488 fix double quotes 2023-05-26 14:37:52 -06:00
clr2of8 be43e3cc29 password policy checks 2023-05-25 17:53:13 -06:00
clr2of8 6a45233b2a password policy checks 2023-05-25 17:45:35 -06:00
clr2of8 652d372f4d password policy checks 2023-05-25 17:42:04 -06:00
clr2of8 0f2d35484f fix regex issue 2023-05-22 11:56:05 -06:00
Clément Notin efd6dbb465 T098: accept UserPrincipalName for the "user_principal_name" argument 
In Azure AD a "user principal name" can be interpreted as the "name of a principal of type user"
or as the "UserPrincipalName (UPN)" user attribute!
But most people will expect the second meaning. Which is confusing since this test actually expects to see
the user display name in this attribute.

I think there was a confusion with the sibling test which is for "service principal",
so for which the argument to designate it by name is "service_principal_name".

With this change, there is no regression while being compatible with people passing a UPN to this argument.
 2023-03-15 18:25:11 +01:00
Clément Notin c14d680bce Improvements to "Azure AD - adding permission to application" 
- Make it clearer that this test will create an app, instead of using an existing one
- If the user ignored this, a second app with the same name as the one they wanted to use will be created. So when using the -Cleanup feature it cannot know which one to delete. Shows a warning then (instead of crashing)
- Some minor English fixes
 2023-02-23 18:39:40 +01:00
Bhavin Patel c3edd4c1ca Merge branch 'master' into pr-use-aad-filter 2023-02-23 09:08:56 -08:00
Clément Notin 4babecb60e Minor English fixes (#2339) 2023-02-21 19:02:06 -07:00
Clément Notin fc5a75efd1 Use -Filter instead of Where-Object to improve perf and avoid missed items 
-Filter is the recommended way to filter objects because it filters them at the source (AAD)
instead of fetching everything and filtering on the client. So the perf are better.
Moreover, by default the cmdlets returns a limited number of items so it can miss stuff
(except if using -All like it was done in some cases)
 2023-02-21 14:33:47 +01:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Atomic Red Team GUID generator 292fcfab98 Generate GUIDs from job=generate-docs branch=master [skip ci] 2022-04-28 01:22:24 +00:00
Rich5 53d54747ec Added Password Change on Directory Service Restore Mode (DSRM) Account (#1899) 
* Added Password Change on Directory Service Restore Mode (DSRM) Account

* remove guid so unique one can be auto-assigned

Co-authored-by: Richard Kelley <richard.kelley@qomplx.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-04-27 19:21:55 -06:00
CircleCI Atomic Red Team GUID generator 1fd5dc6a51 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-03-16 19:30:25 +00:00
WojciechLesicki 8578fc3308 Correct description 2022-03-11 23:52:07 +01:00
Carrie Roberts 9186e32eb2 Merge branch 'master' into master 2022-03-07 11:35:13 -06:00
WojciechLesicki 2be981e92d I added another atomic related to adding permission to the application in AzureAD. 2022-03-06 18:54:11 +01:00
CircleCI Atomic Red Team GUID generator a870578ef4 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-03 17:54:46 +00:00
WojciechLesicki 901633f873 Removing auto_generated_guid 2022-01-31 00:54:57 +01:00
WojciechLesicki d3548bd62e T1098 - adding some Azure atomics 2022-01-30 23:13:58 +01:00
Bhavin Patel fd47161006 AWS Cloud atomics (#1457) 
* cloud atomics

* adding new platform names

* text and variable updates

* minor

* Update T1136.003.yaml

Co-authored-by: bpatel <bpatel@splunk.com>
Co-authored-by: Jose Enrique Hernandez <josehelps@gmail.com>
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
 2021-06-24 14:44:35 -06:00
Jil Larner 70ad88fe10 T1098 - Added cleanup capability (#1216) 
* Changed Admin Account Manipulate to be able to use Cleanup, as suggested in PR #1201

* Changed Admin Account Manipulate to be able to use Cleanup, as suggested in PR #1201

Co-authored-by: Didier Cambefort <didier.cambefort@scrt.ch>
 2020-09-09 10:35:00 -06:00
CircleCI Atomic Red Team doc generator 1427393485 Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-17 16:10:14 +00:00
Jil Larner 6f3085ee17 T1098 - Implemented domain account manipulation (#1201) 
* Implemented Domain account manipulation

* remove manually specified GUID

removing GUID so it can be assigned at merge time.

Co-authored-by: Didier Cambefort <didier.cambefort@scrt.ch>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-08-17 10:09:53 -06:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056) 
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
Carrie Roberts 1bfefdacfc Add elevated (#542) 
* provide elevation_required attribute

* provide elevation_required attribute

* provide elevation_required attribute
 2019-09-03 07:34:42 -06:00
Mo Amiri df6ed4a300 Formatting 2018-05-31 00:52:47 +01:00
caseysmithrc 110739f887 yamilzation 2018-05-24 20:52:47 -06:00