security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,381 Commits 47 Branches 0 Tags
1829f24575043833e95ba5d194e2289170b9aa9e
Commit Graph

1556 Commits

Author SHA1 Message Date
Keith McCammon e1181e7384 Merge OSCD branch into master (#1273) 
* Tests added

* standardize display name

* Add tests for T1134.001 Access Token Impersonation/Theft (#1236)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Changing to device manufacturer based test

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Add test for T1006 Direct Volume Access (#1254)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253)

* T1036.004 - 2 tests added

* Update T1036.004.yaml

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* T1136.002 - 2 tests added (#1252)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] Create atomic test for T1113 for Windows (#1251)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* update T1564.002

* update T1564.002

* add Gatekeeper disable; add cleanup for security tools disable; add another launchagent for carbon black defense; remove Gatekeeper disable command from Gatekeeper bypass technique

* Added T1562.006 tests to emulate indicator blocking by modifying configuration files

* Removed prereq and fixed command endings

* Indirect command execution - conhost (#1265)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] Office persiststence :  Office test (#1266)

* Office persiststence :  Office test

* Added technique details

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Remove index files to avoid CI complaints.

* Grr

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

Co-authored-by: haresudhan <code@0x6c.dev>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Co-authored-by: gregclermont <580609+gregclermont@users.noreply.github.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carl <57147304+rc-grey@users.noreply.github.com>
Co-authored-by: mrblacyk <kweinzettl@gmail.com>
Co-authored-by: sn0w0tter <42819997+sn0w0tter@users.noreply.github.com>
Co-authored-by: Yugoslavskiy Daniil <yugoslavskiy@gmail.com>
Co-authored-by: aw350m3 <aw350m3@yandex.com>
Co-authored-by: omkargudhate22 <36105402+omkar72@users.noreply.github.com>
 2020-10-29 22:54:55 -06:00
CircleCI Atomic Red Team doc generator f1dacdfeb7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-24 14:41:32 +00:00
Carrie Roberts 9658f928e5 better test name (#1261) 
* better name

* Generate docs from job=validate_atomics_generate_docs branch=clr2of8-patch-14

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-24 08:19:12 -06:00
Carrie Roberts 49285769f7 cleaner title (#1260) 
* cleaner title

* Generate docs from job=validate_atomics_generate_docs branch=clr2of8-patch-13

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-24 08:17:34 -06:00
Carrie Roberts 8c75682918 title clarification (#1259) 
* title clarification

* Generate docs from job=validate_atomics_generate_docs branch=clr2of8-patch-12

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-24 08:15:58 -06:00
Carrie Roberts 9e4b0e36d2 move cleanup to cleanup command (#1258) 
* move cleanup to cleanup command

* Generate docs from job=validate_atomics_generate_docs branch=clr2of8-patch-11

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-24 08:15:20 -06:00
CircleCI Atomic Red Team doc generator c9715c0d8c Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-24 14:12:36 +00:00
Michael Haag c8f43265c7 Introducing AtomicTestHarnesses Tests to ART (#1270) 
* Introduce AtomicTestHarness Tests to ART

Adding:
- T1134.004 - Access Token Manipulation: Parent PID Spoofing
- T1218.001 - Signed Binary Proxy Execution: Compiled HTML File
- T1218.005 - Signed Binary Proxy Execution: Mshta

These tests utilize the recently released [AtomicTestHarnesses](https://github.com/redcanaryco/atomictestharnesses) to simulate the base tests from from each ATH Harness. Input arguments may be manipulated as needed to enhance simulation.

* Generate docs from job=validate_atomics_generate_docs branch=atomictestharness-tests

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-22 14:34:31 -06:00
CircleCI Atomic Red Team doc generator 7a1c4e857b Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-21 16:48:59 +00:00
CircleCI Atomic Red Team doc generator 29ae06b032 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-15 16:28:04 +00:00
Micheal Fleck fde64c6173 Update T1012.yaml (#1255) 
Removed extra spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-10-15 10:27:40 -06:00
CircleCI Atomic Red Team doc generator 8f72e4f710 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-14 02:21:45 +00:00
CyberConradWilson 38f7dce9d8 Update T1113.yaml (#1256) 
* Update T1113.yaml

Update test #4 to include a prereq that downloads ImageMagik, updated test #4's name, and updated test #4's description.

* fix yaml spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-10-13 20:21:21 -06:00
CircleCI Atomic Red Team doc generator 0e54272108 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-10 14:35:26 +00:00
CyberConradWilson fad05dbdfa Adding New Test (#1248) 
* Adding New Test

Adding a new test that will invoke the command that Ryuk ransomware uses.

* more descriptive wording

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-10-10 08:35:03 -06:00
Carrie Roberts 1b0994ea9e update/clarify description (#1247) 
* update/clarify description

* Generate docs from job=validate_atomics_generate_docs branch=clr2of8-patch-10

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-10-08 12:03:40 -06:00
CircleCI Atomic Red Team doc generator 408a3b694c Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-08 13:45:04 +00:00
Carl 63c9f570fe Merge branch 'master' into T1115 2020-10-08 07:41:03 -06:00
CircleCI Atomic Red Team doc generator 298a90bcb5 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-08 13:39:28 +00:00
Hare Sudhan Muthusamy 3396ddc13b Merge branch 'master' into T1098.004 2020-10-08 05:55:14 -06:00
Hare Sudhan Muthusamy 35f08a6dc5 Merge branch 'master' into T1115 2020-10-08 05:54:49 -06:00
CircleCI Atomic Red Team doc generator 4e4f8a2775 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-08 02:37:06 +00:00
tuckner b206a0d7cd Add tests for T1070.003 Clear Command History (#1237) 
* feat: add t1070.003 powershell history clear commands

* feat: include preventing powershell logging

* feat: add cleanup command

* consolidate tests, fix typo

Removed the two duplicated atomics that were using aliases for Remove-Item

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-10-07 20:36:04 -06:00
Hare Sudhan Muthusamy a19e9e9797 Update T1115.yaml 2020-10-07 14:05:37 -06:00
Hare Sudhan Muthusamy a690c4ca58 Update T1098.004.yaml 2020-10-07 14:00:26 -06:00
Hare Sudhan Muthusamy 995466a0e3 Changing elevation_required value. 2020-10-07 02:52:19 -06:00
haresudhan 9d574c083b Added T1098.004 tests 2020-10-07 02:45:39 -06:00
haresudhan 3385770a6d Added MacOS tests 2020-10-07 01:55:23 -06:00
CircleCI Atomic Red Team doc generator 8eb52117b7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-10-06 16:13:36 +00:00
Brian Thacker 5ba2d3e985 Update T1550.002.yaml (#1235) 
added code to make prereq commands for test 1.
 2020-10-06 10:13:14 -06:00
CircleCI Atomic Red Team doc generator 23fc9289cf Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 15:47:51 +00:00
xkeyscore007 3cdd80d2f4 Test Case to search a user's bookmarks file from Internet Explorer (#1227) 
* Lists the Ineternet Explorer bookmarks

This command lists the bookmarks for Internet Explorer that are found in the Favorites folder

* Update T1217.yaml

Also, below command can be used to achieve similar results -
dir /s /b C:\Users\%USERNAME%\Favorites

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-29 09:47:02 -06:00
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator f46f1788ab Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-18 18:45:01 +00:00
dwhite9 d3c575085f removed cleanup command that deletes sharphound so the prereq only needs (#1226) 
to be run once.

Co-authored-by: Daniel White <d0w019h@homeoffice.wal-mart.com>
 2020-09-18 12:44:04 -06:00
CircleCI Atomic Red Team doc generator aaf9b7500e Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-18 14:44:29 +00:00
Clément Notin 749006a557 Fix bis 2020-09-18 16:38:41 +02:00
Clément Notin 9e5d5c5cb2 Fix mistake 2020-09-18 16:38:10 +02:00
cnotin 6000965b1e T1028 "Windows Remote Management": split in several techniques 
Fixes #1042
 2020-09-18 15:57:11 +02:00
CircleCI Atomic Red Team doc generator d68a57842a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-16 13:57:33 +00:00
clr2of8 8fed41ac02 removing test 2020-09-16 07:50:24 -06:00
Amine Taouirsa cebd539a36 Update T1218.011.inf (#1223) 
Convert to Mitre ATT&CK sub-technique schema
 2020-09-16 07:29:43 -06:00
CircleCI Atomic Red Team doc generator 30b77fc5a0 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-15 14:57:15 +00:00
Jil Larner 74ad1849de Changed default computer target from computer1 to localhost in the remote execution through MMC (#1218) 
Co-authored-by: Didier Cambefort <didier.cambefort@scrt.ch>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-15 08:56:52 -06:00
CircleCI Atomic Red Team doc generator 00948b0058 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-15 14:53:29 +00:00
Brian Thacker 7b90e89acd Update T1053.003.yaml (#1221) 
Add code to make cleanup commands.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-15 08:53:11 -06:00
CircleCI Atomic Red Team doc generator 45f59adc44 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-09 16:42:32 +00:00
kpsmiley23 e07e8842ef Update T1106.yaml (#1217) 
Execution doesn't currently work because tmp variable was broken

Tested successfully on a local instance

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-09 10:42:10 -06:00
CircleCI Atomic Red Team doc generator 166da61509 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-09 16:41:01 +00:00
Tsora-Pop eb45d7274c New Test T1562.004 (#1215) 
* New test to allow program through firewall

This test will attempt to allow an executable through the system firewall located in the Users directory

* Create AtomicTestPlaceholder

* AtomicTest executable added for test

* Delete AtomicTestPlaceholder

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-09 10:40:38 -06:00