864fee9513
Generated docs from job=generate-docs branch=master [ci skip]
2025-05-01 15:20:38 +00:00
7658548ee4
Update T1562.006.yaml - Adding Atomic Test - Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table ( #3109 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2025-05-01 11:19:44 -04:00
762f0548a1
Generated docs from job=generate-docs branch=master [ci skip]
2025-05-01 15:13:41 +00:00
5ede8f21e4
Generated docs from job=generate-docs branch=master [ci skip]
2025-02-13 22:03:40 +00:00
b138e9a2e7
Generated docs from job=generate-docs branch=master [ci skip]
2024-12-11 01:02:29 +00:00
8a2891aa01
COMPlus_ETWEnabled Atomics ( #3010 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-12-10 18:01:25 -07:00
ad2d7c8f13
Generated docs from job=generate-docs branch=master [ci skip]
2023-11-06 22:42:54 +00:00
62a85c12b5
FreeBSD changes ( #2585 )
...
* freebsd changes
* renaming freebsd to linux
2023-11-06 17:41:43 -05:00
4d6c4e8e23
Generated docs from job=generate-docs branch=master [ci skip]
2023-11-02 00:56:51 +00:00
16b5287208
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-11-02 00:56:30 +00:00
2c1db3e4dd
Merge branch 'master' into master
2023-11-01 19:10:13 -04:00
eec95b5b86
Generated docs from job=generate-docs branch=master [ci skip]
2023-08-02 03:24:15 +00:00
d93ad51c4d
T1562.006 Fix test 6 and 7 ( #2486 )
...
* Fix test6 and 7
Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com >
* Fix Defender key
"KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational"
---------
Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com >
2023-07-17 09:35:42 -06:00
cef46e4479
Generated docs from job=generate-docs branch=master [ci skip]
2023-06-15 16:17:12 +00:00
068d32b1ea
use ExternalPayloads directory ( #2460 )
...
* use ExternalPayloads directory
* use ExternalPayloads directory
* use ExternalPayloads directory
2023-06-15 10:16:12 -06:00
3b8d0af302
Remove auto_generated_guid lines from new entries
...
Some other tiny modifications
2023-06-09 09:11:41 -05:00
86913f3573
Merge branch 'master' of https://github.com/alonsobsd/atomic-red-team
2023-06-01 22:03:39 -05:00
b1f3c968f2
Generated docs from job=generate-docs branch=master [ci skip]
2023-05-19 17:06:33 +00:00
f1c5a9be03
Add FreeBSD support
2023-05-08 11:06:08 -05:00
16594d72c5
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-13 23:11:19 +00:00
a5dd0813cd
fix: Updating atomics YAML file structure to align with the new JSON schema definition ( #2323 )
...
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2023-02-13 16:10:37 -07:00
d0dad62dbc
Generated docs from job=generate-docs branch=master [ci skip]
2022-09-23 22:57:18 +00:00
62adbafbdc
Generated docs from job=generate-docs branch=master [ci skip]
2022-08-03 15:06:50 +00:00
238bc527b7
Generate GUIDs from job=generate-docs branch=master [skip ci]
2022-08-03 15:06:43 +00:00
b31a0b6484
T1562.006-update ( #2066 )
...
Co-authored-by: anupama ramesh <aramesh@nti.local >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2022-08-03 09:06:14 -06:00
724cb3f50d
Generated docs from job=generate-docs branch=master [ci skip]
2022-04-28 01:14:49 +00:00
b196333caf
Generate GUIDs from job=generate-docs branch=master [skip ci]
2022-04-28 01:14:45 +00:00
0ddf5d32aa
Add Atomic tests for disabling .NET ETW tracing ( #1903 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2022-04-27 19:14:22 -06:00
db4ca085fc
Generated docs from job=generate-docs branch=master [ci skip]
2022-04-27 17:08:17 +00:00
94fb215b94
Generate GUIDs from job=generate-docs branch=master [skip ci]
2022-04-27 17:08:13 +00:00
ac8cd38038
Adding T1562.006 Test Number 3 ( #1900 )
...
Adding test #3 to simulate the removal of the Powershell provider ETW telemetry source.
2022-04-27 11:07:43 -06:00
bc21f59ff0
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-04 00:21:31 +00:00
1513717eb2
Updating atomics to conform to standard ( #1619 )
...
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
2021-09-03 18:20:46 -06:00
36d49de4c8
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 17:04:33 +00:00
575b36a8e6
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 15:16:54 +00:00
c14c0357dc
[OSCD Sprint #2 ] Final Pull Request / Summary ( #1431 )
...
* Updating T1016 to include macos firewall enumeration
* Tests added
* standardize display name
* Add tests for T1134.001 Access Token Impersonation/Theft (#1236 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* adding socketfilterfw and cleaning up description formatting, adding description details
* Changing to device manufacturer based test
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Add test for T1006 Direct Volume Access (#1254 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253 )
* T1036.004 - 2 tests added
* Update T1036.004.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* T1136.002 - 2 tests added (#1252 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Create atomic test for T1113 for Windows (#1251 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* update T1564.002
* update T1564.002
* add Gatekeeper disable; add cleanup for security tools disable; add another launchagent for carbon black defense; remove Gatekeeper disable command from Gatekeeper bypass technique
* Added T1562.006 tests to emulate indicator blocking by modifying configuration files
* split linux and macos tests for TT1518.001; update processes list
* Update T1518.001.yaml
* Removed prereq and fixed command endings
* Indirect command execution - conhost (#1265 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Office persiststence : Office test (#1266 )
* Office persiststence : Office test
* Added technique details
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Remove index files to avoid CI complaints.
* Grr
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Update T1518.001.yaml
* [OSCD] Adding T1547.010 (#1264 )
* Port monitor addition
* Rename T1547.010.yml to T1547.010.yaml
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Fixed typos in test names
Co-authored-by: remotephone@gmail.com <remotephone@gmail.com >
Co-authored-by: haresudhan <code@0x6c.dev >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
Co-authored-by: gregclermont <580609+gregclermont@users.noreply.github.com >
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carl <57147304+rc-grey@users.noreply.github.com >
Co-authored-by: mrblacyk <kweinzettl@gmail.com >
Co-authored-by: sn0w0tter <42819997+sn0w0tter@users.noreply.github.com >
Co-authored-by: Yugoslavskiy Daniil <yugoslavskiy@gmail.com >
Co-authored-by: yugoslavskiy <daniil@yugoslavskiy.com >
Co-authored-by: omkargudhate22 <36105402+omkar72@users.noreply.github.com >
Co-authored-by: Keith McCammon <keith@redcanary.com >
Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com >
2021-04-19 11:49:59 -06:00
e1181e7384
Merge OSCD branch into master ( #1273 )
...
* Tests added
* standardize display name
* Add tests for T1134.001 Access Token Impersonation/Theft (#1236 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Changing to device manufacturer based test
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Add test for T1006 Direct Volume Access (#1254 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253 )
* T1036.004 - 2 tests added
* Update T1036.004.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* T1136.002 - 2 tests added (#1252 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Create atomic test for T1113 for Windows (#1251 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* update T1564.002
* update T1564.002
* add Gatekeeper disable; add cleanup for security tools disable; add another launchagent for carbon black defense; remove Gatekeeper disable command from Gatekeeper bypass technique
* Added T1562.006 tests to emulate indicator blocking by modifying configuration files
* Removed prereq and fixed command endings
* Indirect command execution - conhost (#1265 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Office persiststence : Office test (#1266 )
* Office persiststence : Office test
* Added technique details
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Remove index files to avoid CI complaints.
* Grr
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
Co-authored-by: haresudhan <code@0x6c.dev >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
Co-authored-by: gregclermont <580609+gregclermont@users.noreply.github.com >
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carl <57147304+rc-grey@users.noreply.github.com >
Co-authored-by: mrblacyk <kweinzettl@gmail.com >
Co-authored-by: sn0w0tter <42819997+sn0w0tter@users.noreply.github.com >
Co-authored-by: Yugoslavskiy Daniil <yugoslavskiy@gmail.com >
Co-authored-by: aw350m3 <aw350m3@yandex.com >
Co-authored-by: omkargudhate22 <36105402+omkar72@users.noreply.github.com >
2020-10-29 22:54:55 -06:00
Atomic Red Team doc generator