security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,538 Commits 47 Branches 0 Tags
python_conversion
Commit Graph

37 Commits

Author SHA1 Message Date
Atomic Red Team doc generator 5ede8f21e4 Generated docs from job=generate-docs branch=master [ci skip] 2025-02-13 22:03:40 +00:00
Atomic Red Team doc generator 01e281aad2 Generated docs from job=generate-docs branch=master [ci skip] 2024-12-11 00:47:02 +00:00
Nasreddine Bencherchali c800c57aab SDDL Tampering Atomics (#3006) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-12-10 17:46:01 -07:00
Atomic Red Team doc generator a228ee8656 Generated docs from job=generate-docs branch=master [ci skip] 2023-09-22 19:15:21 +00:00
Carrie Roberts d4709021fb Handle spaces in file paths (#2535) 
* updating atomics count in README.md [ci skip]

* wip

* handle spaces in path

* update readme

* fix typo

---------

Co-authored-by: publish bot <opensource@redcanary.com>
 2023-09-22 10:47:25 -06:00
Atomic Red Team doc generator b1f3c968f2 Generated docs from job=generate-docs branch=master [ci skip] 2023-05-19 17:06:33 +00:00
Atomic Red Team doc generator 16594d72c5 Generated docs from job=generate-docs branch=master [ci skip] 2023-02-13 23:11:19 +00:00
Josh Rickard a5dd0813cd fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323) 
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.

This also fixes some white space issues and general line formatting across all impacted atomics.

* fix: One additional change needed

---------

Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2023-02-13 16:10:37 -07:00
Atomic Red Team doc generator c2aca27df1 Generated docs from job=generate-docs branch=master [ci skip] 2023-01-04 03:19:27 +00:00
Atomic Red Team GUID generator b5dde3c8f2 Generate GUIDs from job=generate-docs branch=master [skip ci] 2023-01-04 03:19:21 +00:00
Michael Haag 6db82cba9c T1505.004 - IIS Components & T1562.002 - Disable HTTP logging (#2266) 2023-01-03 22:18:53 -05:00
Atomic Red Team doc generator d0dad62dbc Generated docs from job=generate-docs branch=master [ci skip] 2022-09-23 22:57:18 +00:00
CircleCI Atomic Red Team doc generator 7091fa8b16 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-04-01 14:37:00 +00:00
CircleCI Atomic Red Team doc generator 4173795808 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:35:07 +00:00
CircleCI Atomic Red Team GUID generator 883151e2b7 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:35:01 +00:00
frack113 57c097aac0 Add phant0m test (#1759) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-04 09:34:34 -06:00
CircleCI Atomic Red Team doc generator ae39dcfe39 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-23 21:43:13 +00:00
CircleCI Atomic Red Team GUID generator a612eaebb9 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-23 21:43:08 +00:00
lucasRiley 16bd391f53 Wevtutil Event log Disable (#1633) 
* wevtutil sets the log and then disables it

* update input arg desc

Co-authored-by: Riley <lriley@NTI.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-09-23 15:42:33 -06:00
CircleCI Atomic Red Team doc generator bc21f59ff0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-09-04 00:21:31 +00:00
Josh Rickard 1513717eb2 Updating atomics to conform to standard (#1619) 
* Updated format of input_argument types for Url

* Updated type for input_arguments to Url (missed)

* Updating Path type for input_arguments

* Updated String type for input_arguments

* Missed a few Strings and Url types

* Updated default values for input_arguments to align with their types

* Updated Integer type for input_arguments

* Updated formatting and spacing of atomics
 2021-09-03 18:20:46 -06:00
CircleCI Atomic Red Team doc generator 36d49de4c8 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 17:04:33 +00:00
CircleCI Atomic Red Team doc generator 575b36a8e6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-06-24 15:16:54 +00:00
CircleCI Atomic Red Team doc generator 6bd8fc68e7 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-30 20:53:20 +00:00
tlor89 6b724298f1 T1562.002_Update (#1451) 
Co-authored-by: Toua Lor <tlor@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-04-30 14:53:00 -06:00
CircleCI Atomic Red Team doc generator 07b61288d6 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-02-26 15:49:41 +00:00
BlueTeamOps b91312451f Added auditpol based config clear atomics (#1392) 
* Added auditpol based config clear atomics

Included remove and clear switches for auditpol based logging impairment.

* add warning statement

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-02-26 08:49:14 -07:00
CircleCI Atomic Red Team doc generator adb8256347 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-02-09 18:14:10 +00:00
CircleCI Atomic Red Team GUID generator c5d92bca5d Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-02-09 18:14:01 +00:00
BlueTeamOps f8c8fbcab1 Added Audit Policy Config based Logging Impairment (#1378) 
* Added Audit Policy Config based Logging Impairment

Auditpol can be used to manipulate audit log configuration.  Test 3 simulates the adversary disabling certain audit policies to prevent respective events from being recorded in the log

* Add link, update test name

Adding in the Solarigate write-up link for reference and also removing the test # from the title (this gets added automatically to the Markdown file)

* added cleanup commands

Hi Carrie, The pre-req commands enables the auditpols initially so that it can be disabled when the atomic command is executed.  I have copied the same syntax as pre-req to clean-up so it is reinstated. Based on additional research I have several more commands of interest I would like to add which were not part of the MS article but would be considered suspicious.  Shall I add them as separate tests? i.e. sub-commands such as clear, restore, remove

* Removed the dependency section 

Removed the dependency section

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2021-02-09 11:13:25 -07:00
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator dcb3d26d84 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-04 17:00:36 +00:00
Jesse Moore 74956c4425 Update T1562.002.yaml (#1213) 
Update T1562.002.yaml with Invoke-Phant0m to Kill Windows Event Log Services Threads.
 2020-09-04 10:59:55 -06:00
CircleCI Atomic Red Team doc generator 7e4580a1e8 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-08 21:16:22 +00:00
Hare Sudhan Muthusamy 02ac2deb4f Cleanup fixes (#1108) 
* Cleanup Fixes

* Wrong executor name and missing $ sign in T1553

* Cleanup fixes

* File checks added

* File path error check changed
 2020-07-08 15:15:52 -06:00
CircleCI Atomic Red Team doc generator 8a82e9b66a Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-18 01:57:35 +00:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056) 
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-06-17 12:55:46 -06:00