a8076269ce
Update T1059.004.yaml
2023-02-12 15:22:08 +00:00
7a411af7f6
T1059.004 Added two tests
2023-02-12 15:14:01 +00:00
18767571a5
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-10 19:15:02 +00:00
08c23c0d81
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-02-10 19:14:46 +00:00
b20b72a9a8
Merge branch 'master' into T1546.004
2023-02-10 14:03:06 -05:00
2034b35190
Added two new tests to T1548.001
...
Fixed minor typo in chmod command
2023-02-09 15:10:20 -08:00
78b49d87d2
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-09 16:13:03 +00:00
836b81b127
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-02-09 16:12:48 +00:00
42527f4bdf
Merge branch 'master' into T1048.003_http.server
2023-02-09 10:11:27 -06:00
9d9a7cc251
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-09 16:08:02 +00:00
1b886699f1
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-02-09 16:07:43 +00:00
efaae59060
Merge branch 'master' into T1059.004_four_tests
2023-02-09 10:05:53 -06:00
5c17c4668a
minor update
2023-02-08 14:27:12 +05:30
424bb247a0
Update T1078.003.yaml
2023-02-08 14:23:24 +05:30
b52925c839
Merge branch 'redcanaryco:master' into master
2023-02-08 14:20:18 +05:30
3c22d0867e
Added 3 new testings - macOS
...
3 new tests to add a new account and enable admin privileges
2023-02-08 14:19:07 +05:30
7d7049f64a
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-08 01:33:36 +00:00
291fef80f6
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-02-08 01:33:20 +00:00
07bf46163d
Merge branch 'master' into T1552-007-all-secrets
2023-02-07 17:27:08 -08:00
f11240fd8d
Update T1059.004.yaml
2023-02-07 10:10:37 +00:00
0279620882
Merge branch 'redcanaryco:master' into T1546.004
2023-02-07 10:07:58 +00:00
37e7469b3a
Merge branch 'master' into T1059.004_four_tests
2023-02-07 10:06:34 +00:00
5fc044b874
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-06 22:16:07 +00:00
6dab7992a0
fix: fix: Adding missing index files ( #2320 )
...
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com >
2023-02-06 15:15:23 -07:00
1fe727afc4
fix: Removing index files with colons ( #2319 )
...
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com >
2023-02-06 15:07:17 -07:00
a7e555c092
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-06 20:20:38 +00:00
d61000ff30
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-06 13:25:25 +00:00
0db5a0261a
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-02-06 13:25:17 +00:00
9c20512b68
Begin T1580 Coverage - AWS
...
This commit adds coverage for AWS Cloud Discovery commands run from EC2. Stratus is utilized to spin up and tear down needed testing infrastructure, similar to other cloud coverage in the ART repo previously.
2023-02-04 13:59:57 -05:00
44f5d3ce23
T1546.004
2023-02-04 13:59:36 +00:00
c0bba5e5ec
Update T1552.004.yaml
2023-02-04 06:36:46 -07:00
599e147cfd
ExportPFX
2023-02-04 05:55:40 -07:00
cd3690b100
Generated docs from job=generate-docs branch=master [ci skip]
2023-01-31 14:48:55 +00:00
b12b28bf52
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-01-31 14:48:49 +00:00
1896e182c5
Adding T1112 Mimic Ransomware Registry Modification Tests ( #2306 )
...
Adding T1112 tests 45 and 46 to emulate Mimic ransomware's ability to modify the registry in order to enable multiple user sessions locally, as well as allow multiple RDP sessions per user.
Reference: https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2023-01-31 09:48:20 -05:00
70b897d8d8
Generated docs from job=generate-docs branch=master [ci skip]
2023-01-31 14:45:49 +00:00
8efb2a9443
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-01-31 14:45:42 +00:00
fed5ad2204
Adding T1562.004 Test 18 - Blackbit - Disable Windows Firewall using netsh firewall ( #2305 )
...
* Adding T1562.004 Test 18 - Blackbit - Disable Windows Firewall using netsh firewall
Adding T1562.004 Test 18 - Blackbit - Disable Windows Firewall using netsh firewall. Within BlackBit ransomware, one of the commands ran is "netsh firewall set opmode mode=disable". While "netsh firewall" has been deprecated and replaced with "netsh advfirewall", the old command still does work, leading to a vector that adversaries can use for firewall disablement.
* Adding error handling to cleanup
2023-01-31 09:45:07 -05:00
45964ab763
echo for prereq
2023-01-29 07:21:21 -06:00
5173af83ae
add missing |
2023-01-29 07:19:22 -06:00
2f1cbadead
adding get prereq command
2023-01-29 07:17:55 -06:00
37e1fd7c4d
initial
2023-01-29 06:49:35 -06:00
eed9c5b08d
Merge branch 'master' into T1059.004_four_tests
2023-01-28 17:19:31 +00:00
4ed469e217
T1048.003 Python3 http.server
2023-01-28 09:19:12 +00:00
d15214994a
T1059.004 - Added four tests
2023-01-28 08:38:16 +00:00
a2ccd19c37
Generated docs from job=generate-docs branch=master [ci skip]
2023-01-26 20:13:03 +00:00
ae3d762b50
Fix bz2 command ( #2299 )
...
Details:
Cast bz2content to str to avoid type error. (TypeError: write() argument must be str, not bytes)
Testing:
Local testing was done.
Associated Issues:
N/A
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2023-01-26 15:12:30 -05:00
6c872029ee
Generated docs from job=generate-docs branch=master [ci skip]
2023-01-26 20:11:47 +00:00
fac22a7b8b
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-01-26 20:11:41 +00:00
cbb21a1cc1
Update T1082.yaml ( #2298 )
...
Add new test to simulate behavior recently observed in use by an infostealer family
2023-01-26 15:10:52 -05:00
Biological Robot