9f6a1eab36
Generated docs from job=generate-docs branch=master [ci skip]
2026-02-18 16:55:45 +00:00
376bf2a64d
Generated docs from job=generate-docs branch=master [ci skip]
2026-02-18 16:46:29 +00:00
762f0548a1
Generated docs from job=generate-docs branch=master [ci skip]
2025-05-01 15:13:41 +00:00
5ede8f21e4
Generated docs from job=generate-docs branch=master [ci skip]
2025-02-13 22:03:40 +00:00
e1164d3054
Generated docs from job=generate-docs branch=master [ci skip]
2023-12-27 17:58:55 +00:00
06ebf05785
Added the "-c" option to adfind commands. ( #2645 )
...
* Added the "-c" option to adfind commands. This will cause it to print a
count of the returned objects instead of the actual objects. This is
very useful for large environments and allows it run quicker without
actually exposing any sensitive information.
* Adding the code to allow specifying optional arguments at runtime instead of hardcoding the -c to allow more flexibility per this request:
https://github.com/redcanaryco/atomic-red-team/pull/2645#pullrequestreview-1795339526
---------
Co-authored-by: dwhite <n/a>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
Co-authored-by: dwhite9 <n@a>
2023-12-27 11:58:02 -06:00
c3dc8abb84
Generated docs from job=generate-docs branch=master [ci skip]
2023-11-13 21:46:56 +00:00
7dfdc97d79
FreeBSD Cleanup ( #2603 )
...
* FreeBSD Cleanup
* cleanup
* fix t1016
* reducing multiline if else to single line
* fix t1037.003
* ignore T1003.007
* fix t1003.007
* more fixes
2023-11-13 16:45:43 -05:00
ad2d7c8f13
Generated docs from job=generate-docs branch=master [ci skip]
2023-11-06 22:42:54 +00:00
62a85c12b5
FreeBSD changes ( #2585 )
...
* freebsd changes
* renaming freebsd to linux
2023-11-06 17:41:43 -05:00
4d6c4e8e23
Generated docs from job=generate-docs branch=master [ci skip]
2023-11-02 00:56:51 +00:00
16b5287208
Generate GUIDs from job=generate-docs branch=master [skip ci]
2023-11-02 00:56:30 +00:00
2c1db3e4dd
Merge branch 'master' into master
2023-11-01 19:10:13 -04:00
a228ee8656
Generated docs from job=generate-docs branch=master [ci skip]
2023-09-22 19:15:21 +00:00
d4709021fb
Handle spaces in file paths ( #2535 )
...
* updating atomics count in README.md [ci skip]
* wip
* handle spaces in path
* update readme
* fix typo
---------
Co-authored-by: publish bot <opensource@redcanary.com >
2023-09-22 10:47:25 -06:00
53f605e142
Generated docs from job=generate-docs branch=master [ci skip]
2023-09-12 19:14:33 +00:00
5dc57a112a
handle spaces in file path ( #2527 )
2023-09-12 15:13:14 -04:00
2b77bcb303
Generated docs from job=generate-docs branch=master [ci skip]
2023-06-15 22:33:14 +00:00
a8fe2d2d77
mv adfind to bin ( #2465 )
...
* move adfind to external resource
* mv adfind to bin
2023-06-15 16:32:13 -06:00
282a250cc9
Generated docs from job=generate-docs branch=master [ci skip]
2023-06-15 21:42:03 +00:00
32a4415e43
move adfind to external resource ( #2464 )
2023-06-15 15:40:50 -06:00
03aca258ad
Fix validate issues
2023-06-09 11:36:41 -05:00
3b8d0af302
Remove auto_generated_guid lines from new entries
...
Some other tiny modifications
2023-06-09 09:11:41 -05:00
86913f3573
Merge branch 'master' of https://github.com/alonsobsd/atomic-red-team
2023-06-01 22:03:39 -05:00
210485a6d3
Generated docs from job=generate-docs branch=master [ci skip]
2023-05-31 21:17:38 +00:00
af9378c9f3
update executor ( #2444 )
...
* update executor
* Update T1016.yaml
---------
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-05-31 15:16:42 -06:00
a59de488ff
Generated docs from job=generate-docs branch=master [ci skip]
2023-05-31 20:51:23 +00:00
65294196d0
Spelling adjustments ( #2448 )
...
Looking over the YAMLs mostly, only changes for readability or accuracy
2023-05-31 15:50:22 -05:00
b1f3c968f2
Generated docs from job=generate-docs branch=master [ci skip]
2023-05-19 17:06:33 +00:00
f1c5a9be03
Add FreeBSD support
2023-05-08 11:06:08 -05:00
d26d95d3f7
Generated docs from job=generate-docs branch=master [ci skip]
2023-03-13 18:57:35 +00:00
04b6a8fbc3
Adfind prereq fixes ( #2360 )
...
* doesn't exfil data as written
* update prereqs
---------
Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com >
2023-03-13 12:56:47 -06:00
16594d72c5
Generated docs from job=generate-docs branch=master [ci skip]
2023-02-13 23:11:19 +00:00
a5dd0813cd
fix: Updating atomics YAML file structure to align with the new JSON schema definition ( #2323 )
...
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2023-02-13 16:10:37 -07:00
4787dc43e9
Generated docs from job=generate-docs branch=master [ci skip]
2022-10-24 16:19:18 +00:00
638ba68ee6
Tccontre patch 1 ( #2200 )
...
* Update T1124.yaml
* Update T1033.yaml
* Update T1033.yaml
* Update T1033.yaml
* Update T1033.yaml
* Update T1033.yaml
* Update T1016.yaml
* Update T1016.yaml
* update test name
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2022-10-24 10:18:40 -06:00
5ea7cb3010
Generated docs from job=generate-docs branch=master [ci skip]
2022-09-22 22:37:42 +00:00
308634b0ec
T1016 ( #2157 )
...
Co-authored-by: Toua Lor <tlor@nti.local >
2022-09-22 16:37:14 -06:00
819934cc3f
Generated docs from job=generate-docs branch=master [ci skip]
2022-06-16 22:47:00 +00:00
7091fa8b16
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2022-04-01 14:37:00 +00:00
4b1bc4557e
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-11-19 18:43:15 +00:00
4a5881e343
Linux prereq updates ( #1673 )
...
* T1070.003-9 update (get_)prereq_commmand
- moved system changes to the get_prereq(s)
- ubuntu `passwd` didn't accept `--stdin`
- updated get_prereqs for both ubuntu/centos
* T1016 - update prereq
* T1018 - update prereq
* T1562.001 - update rsyslog prereq
* T1560.001 updates dep check/install, update default likely to exist
switch to /var/log/wtmp and /var/log/btmp vs ${HOME}/*.txt, since those will
always be present
tests for zip in the prereq
adds deb/rpm install for zip
* T1486 - update getprereqs
* T1135 - update prereqs
* T1046 - update prereqs
* T1040 - update prereqs
2021-11-19 11:42:46 -07:00
36d49de4c8
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 17:04:33 +00:00
575b36a8e6
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 15:16:54 +00:00
c14c0357dc
[OSCD Sprint #2 ] Final Pull Request / Summary ( #1431 )
...
* Updating T1016 to include macos firewall enumeration
* Tests added
* standardize display name
* Add tests for T1134.001 Access Token Impersonation/Theft (#1236 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* adding socketfilterfw and cleaning up description formatting, adding description details
* Changing to device manufacturer based test
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Add test for T1006 Direct Volume Access (#1254 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253 )
* T1036.004 - 2 tests added
* Update T1036.004.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* T1136.002 - 2 tests added (#1252 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Create atomic test for T1113 for Windows (#1251 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* update T1564.002
* update T1564.002
* add Gatekeeper disable; add cleanup for security tools disable; add another launchagent for carbon black defense; remove Gatekeeper disable command from Gatekeeper bypass technique
* Added T1562.006 tests to emulate indicator blocking by modifying configuration files
* split linux and macos tests for TT1518.001; update processes list
* Update T1518.001.yaml
* Removed prereq and fixed command endings
* Indirect command execution - conhost (#1265 )
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* [OSCD] Office persiststence : Office test (#1266 )
* Office persiststence : Office test
* Added technique details
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Remove index files to avoid CI complaints.
* Grr
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Update T1518.001.yaml
* [OSCD] Adding T1547.010 (#1264 )
* Port monitor addition
* Rename T1547.010.yml to T1547.010.yaml
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Generate docs from job=validate_atomics_generate_docs branch=oscd
* Fixed typos in test names
Co-authored-by: remotephone@gmail.com <remotephone@gmail.com >
Co-authored-by: haresudhan <code@0x6c.dev >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
Co-authored-by: gregclermont <580609+gregclermont@users.noreply.github.com >
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carl <57147304+rc-grey@users.noreply.github.com >
Co-authored-by: mrblacyk <kweinzettl@gmail.com >
Co-authored-by: sn0w0tter <42819997+sn0w0tter@users.noreply.github.com >
Co-authored-by: Yugoslavskiy Daniil <yugoslavskiy@gmail.com >
Co-authored-by: yugoslavskiy <daniil@yugoslavskiy.com >
Co-authored-by: omkargudhate22 <36105402+omkar72@users.noreply.github.com >
Co-authored-by: Keith McCammon <keith@redcanary.com >
Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com >
2021-04-19 11:49:59 -06:00
7e974e12f2
Update qakbot.bat ( #1393 )
...
Updated qakbot recon command list as reported by DFIR Reports: https://twitter.com/TheDFIRReport/status/1361331598344478727
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-02-18 08:52:00 -07:00
e9cb3c2f59
Update README.md ( #1302 )
...
* Update README.md
Updating execution frameworks link.
* Generate docs from job=validate_atomics_generate_docs branch=mgraeber-rc-patch-1
* Generate docs from job=validate_atomics_generate_docs branch=mgraeber-rc-patch-1
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Michael Haag <mike@redcanary.com >
2020-11-30 09:18:32 -07:00
d0b51ff08a
T1016 qakbot addition ( #1288 )
...
* Create qakbot.bat
* Update T1016.yaml
Recon commands believed to be associated with Qakbot reconnaissance techniques.
https://hybrid-analysis.com/sample/fcdfd33bebc7a7fe02854ecb60aa17bf0bd85d0b78cc5bc07ceb93a5116639cd/5f63d0b54f389a2d7573a8ce
https://www.virustotal.com/gui/file/fcdfd33bebc7a7fe02854ecb60aa17bf0bd85d0b78cc5bc07ceb93a5116639cd/detection
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-11-17 19:29:55 -07:00
0ff4aada24
Generate docs from job=validate_atomics_generate_docs branch=ATHPowerShellCommandLineParamter
2020-11-09 16:41:52 +00:00
ba178ad2b9
add prereqs for adfind tests ( #1282 )
...
* add prereqs for adfind
* typo fixes and executor change
2020-11-06 09:17:04 -07:00
Atomic Red Team doc generator