06f28fd039
Creation of T1614.yaml and T1016.001.yaml ( #2901 )
...
* Create T1614.yaml
* Create T1016.001
* Update T1016.001
* correct Technique # in YAML file
* remove duplicate tests
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-12 19:53:57 -05:00
32da9c87c1
Update T1546.yaml - New Test - Persistence using STARTUP-PATH in MS-WORD ( #2899 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-12 19:33:48 -05:00
39ba130848
Update T1574.001.yaml ( #2898 )
...
Phantom Dll Hijacking - ualapi.dll
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-12 19:17:01 -05:00
fc96766873
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-06 08:13:06 +00:00
e42ce19a1c
Fix T1543.002.yaml ( #2893 )
...
* Adding elevation required to test 1
* Adding elevation required to test 2 as well
---------
Co-authored-by: Hare Sudhan <code@0x6c.dev >
2024-08-06 04:10:56 -04:00
c4f6c86954
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-06 08:06:00 +00:00
5f5ed55d02
Fix T1003.008.yaml ( #2891 )
...
* Replacing wrong reference to input variable
* Undoing the change on md file
---------
Co-authored-by: Hare Sudhan <code@0x6c.dev >
2024-08-06 04:04:47 -04:00
7a17b396d2
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-06 08:03:09 +00:00
932fd8321e
Update T1059.004.yaml ( #2894 )
...
* Update T1059.004.yaml
Added a new atomic test
name: emacs spawning an interactive system shell
* Update T1059.004.yaml
Added new test supports bothe Linuc n Mac
added brew install prereq as well to support mac
Test name: emacs spawning an interactive system shell
2024-08-06 04:01:57 -04:00
30a2f6f601
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:37:27 +00:00
de8cc181a6
Update T1082.yaml ( #2895 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:36:16 -05:00
1157183f0a
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:32:44 +00:00
f85294b90d
Update T1564.003.yaml ( #2884 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:31:32 -05:00
4a087e79e5
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:30:28 +00:00
a1d2de5f9c
Update T1546.yaml ( #2883 )
...
New Test Added : Load custom DLL on mstsc execution
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:29:01 -05:00
e580d4420f
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:27:36 +00:00
5182c34b07
New Test : Leverage Virtual Channels to execute custom DLL during successful RDP session ( #2882 )
...
* Update T1547.yaml
New Test Added : Leverage Virtual Channels to execute custom DLL during successful RDP session
* Update T1547.yaml
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:26:27 -05:00
16bb157750
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:25:14 +00:00
fba22ab5e3
Update T1574.002.yaml ( #2881 )
...
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe", which can load further executables embedded in modified KeyScramblerIE.dll file.
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:24:08 -05:00
e6469976ec
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-03 01:17:47 +00:00
d27673ede6
Update T1546.yaml ( #2880 )
...
* Update T1546.yaml
New Test Added : Persistence using automatic execution of custom DLL during RDP session
* Update T1546.yaml
* Update T1546.yaml
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-08-02 20:16:39 -05:00
aa9410b161
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-02 21:45:08 +00:00
8e18cafebb
Fix 1046.yaml ( #2892 )
...
* Adding the --rm option in the docker run command
* Fix the docker exec command
* Added the dockerfile path as input arg
* Fixing the reference to the dockerfile filepath
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2024-08-02 14:43:58 -07:00
47a7a1525f
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-02 21:39:16 +00:00
366ff6f084
Fix T1613.yaml ( #2886 )
...
* Fixing several issues on T1613 test
* Undoing the md file fix
* Undoing the md file fix and fixing also test 2
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2024-08-02 14:38:09 -07:00
d143f79024
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-01 23:51:58 +00:00
4a11a17dba
Fix T1612.yaml ( #2887 )
...
* Adding the docker rm option
* Undoing the md file fix
---------
Co-authored-by: Hare Sudhan <code@0x6c.dev >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2024-08-01 16:50:50 -07:00
67520627ff
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-01 23:47:03 +00:00
95ef62dd1e
Update T1562.008.yaml ( #2888 )
...
* Added the AWS platform to test 5
* Undoing the md file fix
2024-08-01 16:45:54 -07:00
88851e2bea
Generated docs from job=generate-docs branch=master [ci skip]
2024-08-01 03:53:03 +00:00
c8926e03c0
Update T1059.004.yaml ( #2871 )
...
* Update T1059.004.yaml
* Update T1059.004.yaml
* Update T1059.004.yaml
---------
Co-authored-by: Hare Sudhan <code@0x6c.dev >
2024-07-31 23:51:49 -04:00
bee5a4c48f
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 14:41:19 +00:00
af560d5067
Update T1546.008.yaml ( #2878 )
...
New Test Added : Auto-start application on user logon
Existing Test Atbroker.exe (AT) Executes Arbitrary Command via Registry Key added modified for addition of elevated privileges to carry out the required testing
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-24 09:40:14 -05:00
f368a70546
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 14:38:05 +00:00
13f7dde9a3
Update T1574.001.yaml ( #2877 )
...
New test Added : Phantom Dll Hijacking - WinAppXRT.dll
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-24 09:36:55 -05:00
83c5d69c55
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 14:35:18 +00:00
1c0f195934
Update T1547.yaml ( #2875 )
...
adding new atomic realted to pnputil to cover different set of command line arguments for pnputil. pnputil can be abused to install drivers in windows
Test Name: Driver Installation Using pnputil.exe
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-24 09:34:09 -05:00
9418990356
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 14:32:32 +00:00
ba841eba7a
Update T1217.yaml ( #2876 )
...
* Update T1217.yaml
This test will extract Microsoft Edge browser's history of current user
* Update T1217.yaml
* Update T1217.yaml
* remove duplicate test
* Update T1217.yaml
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-24 09:31:17 -05:00
33939648b7
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:37:54 +00:00
5fc2f6dd5f
Update T1218.yaml ( #2855 )
...
* Update T1218.yaml
* Update T1218.yaml
* Update T1218.yaml
---------
Co-authored-by: Hare Sudhan <code@0x6c.dev >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-23 21:36:46 -05:00
b0f5fc12dd
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:31:35 +00:00
19fbe0f994
Update T1112.yaml ( #2870 )
...
Added New Test : Adding custom paths for application execution
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-23 21:29:27 -05:00
444f81d64f
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:28:03 +00:00
7c1d934430
Update T1569.002.yaml ( #2869 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-23 21:26:56 -05:00
f1fd271ee0
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:24:52 +00:00
a8585e0e50
Update T1078.003.yaml ( #2867 )
...
Added new test "Use PsExec to elevate to NT Authority\SYSTEM account"
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-23 21:23:48 -05:00
e1feb2c7a5
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:21:57 +00:00
bd13bcbaec
Update T1546.yaml ( #2865 )
...
New Test : Adding custom debugger for Windows Error Reporting
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2024-07-23 21:20:48 -05:00
2d3c1652a4
Generated docs from job=generate-docs branch=master [ci skip]
2024-07-24 02:17:35 +00:00
Marco Pedrinazzi