171d9d5e72
Merge branch 'master' into gk-atomic-red-team-T1531-Account-Deletion
2023-03-17 08:34:04 +00:00
8025353c3d
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-16 23:41:15 +00:00
d62766548b
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-03-16 23:40:55 +00:00
73a144caa6
T1033-whoami-simplification ( #2370 )
...
* Variation on system/user discovery
Slight variation on Test 1: System Owner/User Discovery. This is meant to be a stripped down version.
* Update T1033.yaml
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2023-03-16 17:39:46 -06:00
077f0ac288
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-16 23:36:29 +00:00
824eb46e08
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-03-16 23:36:12 +00:00
011e512d29
add Cobalt Strike named pipe atomics ( #2372 )
2023-03-16 17:35:10 -06:00
9cbcd8977c
update T1562.004 with more commands
2023-03-16 17:49:53 +01:00
809970561a
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-16 15:51:28 +00:00
9fed5b2315
remove unused input arg ( #2368 )
...
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-16 09:50:15 -06:00
7db6b229bd
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-16 15:48:11 +00:00
6a7bdf14d9
remove unused input arg ( #2367 )
...
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-16 09:47:23 -06:00
535c693a65
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-16 15:44:49 +00:00
4d272cdcdc
remove unused inputargs ( #2366 )
2023-03-16 09:44:03 -06:00
cc251318dc
update T1012 with more commands
2023-03-15 20:10:31 +01:00
efd6dbb465
T098: accept UserPrincipalName for the "user_principal_name" argument
...
In Azure AD a "user principal name" can be interpreted as the "name of a principal of type user"
or as the "UserPrincipalName (UPN)" user attribute!
But most people will expect the second meaning. Which is confusing since this test actually expects to see
the user display name in this attribute.
I think there was a confusion with the sibling test which is for "service principal",
so for which the argument to designate it by name is "service_principal_name".
With this change, there is no regression while being compatible with people passing a UPN to this argument.
2023-03-15 18:25:11 +01:00
92c180bf43
Merge branch 'redcanaryco:master' into gk-atomic-red-team-T1531-Account-Deletion
2023-03-14 07:53:42 +00:00
159dda49d8
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-14 00:45:40 +00:00
de0f49fb5c
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-03-14 00:45:21 +00:00
9a084cbf66
Merge branch 'master' into Azure_Persistence_Automation_Runbook_Created_or_Modified
2023-03-13 17:44:08 -07:00
f6437b843f
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-14 00:43:58 +00:00
56840ea08a
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-03-14 00:43:40 +00:00
8a6b82d185
Merge branch 'master' into gk-atomic-red-team-T1136.003-Azure-CLI
2023-03-13 20:41:10 +00:00
d26d95d3f7
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-13 18:57:35 +00:00
04b6a8fbc3
Adfind prereq fixes ( #2360 )
...
* doesn't exfil data as written
* update prereqs
---------
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-13 12:56:47 -06:00
c86971b4e7
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-13 18:54:24 +00:00
dbcf181202
fix typo ( #2358 )
...
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-13 12:53:33 -06:00
c42cd26868
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-13 18:41:34 +00:00
08f1fdcc2b
use ART repo instead of ARTifacts ( #2361 )
...
* use ART repo instead of ARTifacts
* typo fix
2023-03-13 12:40:49 -06:00
1e3ecda292
Update T1531.yaml
...
removed special character causing an error
2023-03-11 14:07:32 +00:00
949d151fc2
Update T1531.yaml
...
Added two account deletion tests for Azure AD, one via Azure CLI and another using AzureAD PowerShell Module
2023-03-11 14:03:40 +00:00
c0b144a44a
Update T1136.003.yaml
...
removed auto_generated_guid field that was failing checks
2023-03-11 13:40:18 +00:00
434a54490d
Update T1136.003.yaml
...
fixed a couple of typos and removed a blank line
2023-03-11 07:51:42 +00:00
cd12370a63
Update T1136.003.yaml
2023-03-10 21:49:39 +00:00
937c62b9be
Update T1136.003.yaml
2023-03-10 21:28:09 +00:00
13c3f8361f
Update T1136.003.yaml
...
Added the same technique but via the azure cli with an automated login atomic which then creates anew user via the Azure CLI
2023-03-10 21:27:27 +00:00
cf4acdc527
Merge branch 'master' into Azure_Persistence_Automation_Runbook_Created_or_Modified
2023-03-09 14:44:58 -08:00
b65e562290
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-09 22:42:27 +00:00
aaf3fd5992
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-03-09 22:42:12 +00:00
6a4d1571f3
remove guid key
2023-03-09 14:39:07 -08:00
9e0e9ebae4
Merge branch 'master' into gk-atomic-red-team-T1136.003-UPDATE
2023-03-09 14:37:57 -08:00
f982fdda71
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-09 16:50:59 +00:00
8863da1c40
T1112: fix typo ( #2357 )
...
fix typo
2023-03-09 09:49:28 -07:00
6cf33d4a79
Update T1078.004.yaml
...
updated "Azure Persistence Automation Runbook Created or Modified" scenario
2023-03-07 15:39:29 +05:30
e02b05f3b8
Update T1078.004.yaml
...
Updated "Azure Persistence Automation Runbook Created or Modified" scenario.
2023-03-07 15:33:43 +05:30
83a170407a
Merge branch 'redcanaryco:master' into gk-atomic-red-team-T1136.003-UPDATE
2023-03-04 15:30:26 +00:00
f296668303
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-02 15:30:01 +00:00
ccfababf58
T1140 bash base64 decode ( #2353 )
...
* added a new test for base64 encoded shebang shells
* updated description
---------
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-02 08:29:17 -07:00
c1079b58f6
Merge branch 'redcanaryco:master' into gk-atomic-red-team-T1136.003-UPDATE
2023-03-02 14:40:19 +00:00
16c9bcfc07
Update T1136.003.yaml
...
Changed the way I did the test after some additional testing and playing around.
2023-03-02 14:39:37 +00:00
Gavin Knapp