security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,538 Commits 47 Branches 0 Tags
python_conversion
Commit Graph

44 Commits

Author SHA1 Message Date
Martha Sosa 779d1b0668 Marthajsosa patch 1 (#3069) 2025-03-01 17:54:39 -06:00
Hare Sudhan bfdd702717 Remove unused variable (#3040) 2025-01-28 00:02:41 -05:00
AlbertoPellitteri ff923c6ab7 Remove sudo command from test, since the elevation required was already set (#2923) 
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2024-09-10 21:32:56 +05:30
Atomic Red Team doc generator 1b8b66b6fe Generated docs from job=generate-docs branch=master [ci skip] 2024-05-10 14:47:37 +00:00
Leo Verlod b4c30600a8 Update T1135.yaml (#2761) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-05-09 11:44:13 -05:00
publish bot dd4372d5cd updating atomics count and guids [ci skip] 2024-04-25 17:07:26 +00:00
Leo Verlod a7a16b3471 Update T1135.yaml (#2745) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-04-23 19:36:34 -05:00
Hare Sudhan 62a85c12b5 FreeBSD changes (#2585) 
* freebsd changes

* renaming freebsd to linux
 2023-11-06 17:41:43 -05:00
Atomic Red Team GUID generator 16b5287208 Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-11-02 00:56:30 +00:00
Jose Enrique Hernandez 2c1db3e4dd Merge branch 'master' into master 2023-11-01 19:10:13 -04:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Carrie Roberts 068d32b1ea use ExternalPayloads directory (#2460) 
* use ExternalPayloads directory

* use ExternalPayloads directory

* use ExternalPayloads directory
 2023-06-15 10:16:12 -06:00
Alonso Cárdenas 3b8d0af302 Remove auto_generated_guid lines from new entries 
Some other tiny modifications
 2023-06-09 09:11:41 -05:00
Alonso Cárdenas 86913f3573 Merge branch 'master' of https://github.com/alonsobsd/atomic-red-team 2023-06-01 22:03:39 -05:00
tccontre 215ead274f Update T1135.yaml - network share discovery via dir cmd (#2436) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-05-23 07:40:15 -06:00
Alonso Cárdenas f1c5a9be03 Add FreeBSD support 2023-05-08 11:06:08 -05:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Dan b1f18f38ff Update T1135-2 (#2021) 
Run smbstatus with sudo

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-07-01 20:42:09 -06:00
Atomic Red Team GUID generator adb646ae82 Generate GUIDs from job=generate-docs branch=master [skip ci] 2022-05-10 16:36:35 +00:00
dwhite9 7a915d3af1 Added network share enumeration test sourced from WinPwn script. (#1938) 
**Details**
https://github.com/S3cur3Th1sSh1t/WinPwn/

**Testing**
Tested on Windows 10 VM

Co-authored-by: Daniel White <d0w019h@homeoffice.wal-mart.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-05-10 10:36:08 -06:00
glallen a83e73fbe4 adds prereq for lsof/T1087.001, fixes other broken prereq cmds (#1774) 
- several instances of: `yum -y epel-release rsyslog` missing an `install`
- adds dependency for lsof
 2022-02-10 07:39:32 -07:00
CircleCI Atomic Red Team GUID generator ea555fab07 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-12-09 22:52:52 +00:00
lucasRiley c05e8c7dde T1135 Powerview (#1686) 
* T1135 Powerview

* Update T1135.yaml

* Simplifying updates

Co-authored-by: Riley <lriley@NTI.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-12-09 15:52:22 -07:00
glallen 4a5881e343 Linux prereq updates (#1673) 
* T1070.003-9 update (get_)prereq_commmand

- moved system changes to the get_prereq(s)
- ubuntu `passwd` didn't accept `--stdin`
- updated get_prereqs for both ubuntu/centos

* T1016 - update prereq

* T1018 - update prereq

* T1562.001 - update rsyslog prereq

* T1560.001 updates dep check/install, update default likely to exist

switch to /var/log/wtmp and /var/log/btmp vs ${HOME}/*.txt, since those will
always be present

tests for zip in the prereq

adds deb/rpm install for zip

* T1486 - update getprereqs

* T1135 - update prereqs

* T1046 - update prereqs

* T1040 - update prereqs
 2021-11-19 11:42:46 -07:00
Josh Rickard 1513717eb2 Updating atomics to conform to standard (#1619) 
* Updated format of input_argument types for Url

* Updated type for input_arguments to Url (missed)

* Updating Path type for input_arguments

* Updated String type for input_arguments

* Missed a few Strings and Url types

* Updated default values for input_arguments to align with their types

* Updated Integer type for input_arguments

* Updated formatting and spacing of atomics
 2021-09-03 18:20:46 -06:00
Josh Rickard df34cadff9 T1135 - Fixed key name in executor test (#1552) 
* Fixed key name of `elevation_require` to `elevation_required`
 2021-07-19 14:51:21 -06:00
Michael Haag f85d4a0d65 Update T1135.yaml (#1533) 
Updated and confirmed operational. #1441

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-06-28 08:56:57 -06:00
SecurityShrimp 42799b033d added TLS/SSL v1.2 enabling commands to any atomic test utilizing IWR (#1519) 
* Update T1204.002.md

Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with 

```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12```

* Update T1555.yaml

added line to set ssl/tls version

* Update T1134.001.yaml

updated IWR lines to allow ssl/tls version 1.2

* Update T1069.002.yaml

added lines to every IWR instance to set ssl/tls version to 1.2

* Update T1558.003.yaml

added line to allow TLS/SSL 1.2

* Update T1033.yaml

added command to enable SSL/TLS v1.2

* Update T1055.012.yaml

added command to enable TLS/SSL v1.2

* Update T1115.yaml

Added command to enable SSL/TLS v1.2

* Update T1070.001.yaml

added command enabling SSL/TLS v 1.2

* Update T1564.yaml

added commands to enable SSL/TLS v 1.2

* Update T1566.001.yaml

added command to enable SSL/TLS V1.2

* Update T1135.yaml

added command to enable SSL/TLS v1.2

* Update T1055.yaml

added commands to enable TLS/SSL v 1.2

* Update T1110.003.yaml

added command to enable TLS/SSL v1.2

* Update T1003.yaml

Added command to enable TLS/SSL v1.2

* Update T1053.005.yaml

added command to enable TLS/SSL v1.2

* Update T1003.001.yaml

added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest

* Update T1069.002.yaml

syntax correction

* Update T1134.001.yaml

syntax correction

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-06-16 12:41:04 -06:00
CircleCI Atomic Red Team GUID generator 518aad427a Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-05-21 19:40:03 +00:00
Brian Thacker a0a56474ae Update T1135.yaml 
Split test 1 into two tests one for macos and one for Linux. Linux test added prereq commands and used a different tool.
 2021-05-09 17:43:33 -05:00
Carrie Roberts 678d9c5444 remove non-PS command and incorrect param (#1413) 
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
 2021-04-08 07:08:08 -06:00
Carrie Roberts 8b6c9af427 add usebasicparsing flag (#1410) 2021-04-02 07:28:29 -06:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056) 
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator 9e89627f3b Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-21 21:30:14 +00:00
Andrew Beers 155e585847 write test (#1002) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-05-21 15:29:34 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
Andrew Beers 6469c41198 Success Descriptions 3rd Batch (#895) 
* Success Descriptions 3rd Batch

* typo fix

* wording

* typo fix

* improve description

* remove update for now

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-03-19 16:02:55 -06:00
Andrew Beers a0b8d7e438 More test improvements (#732) 
* update tests

* T1518 improvements

* remove prereq commands

* fix typo

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-01-06 14:17:45 -07:00
Andrew Beers f39c39b29a Batch of improvements (#721) 
* another batch of improvements

* delete duplicate test, extra cleaining pass

* Improve Tests

* Delete test that is way to specific to be usefull
 2019-12-16 16:54:01 -07:00
Andrew Beers 3c9704117d T1135 recon avalaible share drives (#670) 
* net share command

* update description
 2019-11-18 13:39:58 -07:00
Carrie Roberts 1bfefdacfc Add elevated (#542) 
* provide elevation_required attribute

* provide elevation_required attribute

* provide elevation_required attribute
 2019-09-03 07:34:42 -06:00
Austin Robertson 5cb3fed680 General YAML cleanup (#305) 
* Fix string interpolation from ${foo} to #{foo} across all atomics

* remove non-ASCII characters from atomics YAML

* fix erroneous input_arguments
 2018-07-26 16:31:50 -06:00
Swelc 28c72ce9f4 Added Windows share enumeration. 2018-06-28 18:04:50 -05:00
Michael Haag f09c2aef6a Bunches of Mac converted to YAML 2018-05-25 12:21:10 -04:00