2a6a82f945
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-15 02:11:02 +00:00
358124ee2d
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-15 02:10:57 +00:00
ef9870b4a0
T1555.003_Update ( #1626 )
...
* T1555.003_Update
* Update T1555.003.yaml
Made the recommend changes
* description update
Co-authored-by: Toua Lor <tlor@nti.local >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-09-14 20:10:23 -06:00
1173a5f1f3
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-15 01:29:34 +00:00
f7404e80e8
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-15 01:29:29 +00:00
f2201c7d4d
Update T1069.001.yaml ( #1627 )
2021-09-14 19:29:06 -06:00
12ca65b029
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-10 15:56:41 +00:00
f6849b45b8
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-10 15:56:35 +00:00
c8aebb9a41
Add SharpHound LocalAdmin attack ( #1625 )
2021-09-10 09:56:00 -06:00
895016b6bd
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-10 15:47:32 +00:00
76420cb24e
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-10 15:47:27 +00:00
adb2b53f0f
T1187: PetitPotam coerce authentication attack ( #1620 )
...
* Add PetitPotam coerce authentication attack
* Change executable URL to a permalink
* Fix cleaning
Co-authored-by: Clément Notin <cnotin@tenable.com >
2021-09-10 09:47:00 -06:00
a7e6de503a
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 21:10:42 +00:00
d5c9c01e4f
Update T1047.yaml ( #1624 )
2021-09-09 15:10:08 -06:00
b66dfc7001
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 20:59:14 +00:00
acd77c68cb
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 20:59:10 +00:00
167fb3c2f6
T1047_update ( #1623 )
...
* T1047_update
* T1047_update
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-09-09 14:58:43 -06:00
217dc47106
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 18:05:56 +00:00
1605c05954
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 18:05:50 +00:00
fbbdd008ac
Add test Windows - Disable the SR scheduled task ( #1622 )
...
Use schtasks.exe to disable the System Restore (SR) scheduled task
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-09-09 12:05:16 -06:00
ba0b1a3c35
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 18:02:46 +00:00
356a8bbe88
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-09 18:02:40 +00:00
6d46517d6f
T1105 add test download with imewdbld ( #1621 )
...
* Add test "Download a file with IMEWDBLD.exe"
IMEWDBLD.exe can be used to download files from third party websites. This will throw an error for an invalid dictionary but the file will still be downloaded.
Commands to execute this activity and cleanup commands added.
Cleanup commands call on cmd.exe because PowerShell by default would not remove those files.
Disclosed by https://twitter.com/notwhickey
https://twitter.com/notwhickey/status/136749340683504026
* Update T1105.yaml
fixed typo test 17
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-09-09 12:02:26 -06:00
4114a92cfa
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-08 16:17:12 +00:00
095df1c717
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-08 16:17:08 +00:00
4fad473a71
Merge pull request #1606 from piaconsigny/pr-golden-saml
...
T1606.002: Add Golden SAML atomic
2021-09-08 09:16:36 -07:00
4cdedbef11
Merge branch 'master' into pr-golden-saml
2021-09-08 09:15:57 -07:00
f72420bbcc
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-04 00:27:02 +00:00
e4bfc77bf2
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-04 00:26:58 +00:00
ae0fd36089
Added ScreenConnect application ( #1618 )
...
* Added ScreenConnect application
* update line spacing
* some wording updates and cleanup.
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-09-03 18:26:26 -06:00
bc21f59ff0
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-04 00:21:31 +00:00
1513717eb2
Updating atomics to conform to standard ( #1619 )
...
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
2021-09-03 18:20:46 -06:00
bcedc9a826
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-02 15:24:25 +00:00
216113c9bf
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-02 15:24:20 +00:00
ab822b2208
Trust Reconnaissance ( #1616 )
...
Two simple Atomic Tests for domain and forest trust information.
2021-09-02 09:23:44 -06:00
fb6a424ec1
Update README.md ( #1615 )
...
Added single character to reflect changes on websites and in wiki.
2021-09-01 16:59:18 -06:00
2892843e35
Merge pull request #1614 from redcanaryco/complete-art-io-site-migration
...
Delete docs directory
2021-08-30 12:53:26 -07:00
0ce485a43b
Merge branch 'master' into complete-art-io-site-migration
2021-08-30 13:52:54 -06:00
38b2b2f2d3
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-08-30 19:52:44 +00:00
1d43b259fa
Merge branch 'master' into complete-art-io-site-migration
2021-08-30 13:52:44 -06:00
7e4f6a4b88
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-08-30 19:52:38 +00:00
762e2992a7
Merge branch 'master' into complete-art-io-site-migration
2021-08-30 13:52:32 -06:00
aca73307fa
Add test "Remove the Zone.Identifier alternate data stream" ( #1612 )
...
Add test "Remove the Zone.Identifier alternate data stream". Test command removes the zone.identifier. The cleanup command adds the zone.identifier with the id for "internet". Check prereq checks that the test file exists. Get prereq gets the file from the internet and adds the zone.identifier with the id for "internet".
More info:
https://www.howtogeek.com/70012/what-causes-the-file-downloaded-from-the-internet-warning-and-how-can-i-easily-remove-it/
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7
https://www.reddit.com/r/PowerShell/comments/6yyf07/remove_alternate_data_streams/dmrb6zl/
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-08-30 13:52:02 -06:00
fc96cac822
Delete docs directory
...
Migrated atomicredteam[.]io site to new location.
2021-08-30 12:44:02 -07:00
e95076c17d
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-08-30 19:16:31 +00:00
78a438c687
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-08-30 19:16:26 +00:00
5bda040ce8
Updated O365-Disable-AntiPhishRule test ( #1611 )
...
* updated O365-Disable-AntiPhishRule test
* updated as per review comments
Co-authored-by: Araveti Esanya Reddy <esanya.araveti@kudelskisecurity.com >
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-08-30 13:15:58 -06:00
9965165d19
Delete CNAME ( #1613 )
...
Removing file in prep to migrate atomicredteam[.]io site.
2021-08-30 13:13:57 -06:00
19146099ab
Create CNAME
2021-08-30 13:09:12 -06:00
b10ba3ecde
Delete CNAME
2021-08-30 13:08:38 -06:00
CircleCI Atomic Red Team doc generator