ebfc28708d
Generated docs from job=generate-docs branch=master [ci skip]
2022-05-17 22:48:32 +00:00
c171910f63
typo fix ( #1973 )
2022-05-17 16:48:04 -06:00
4c36b9b772
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-12-30 19:08:33 +00:00
e0f2a76114
Update T1003.yaml ( #1702 )
...
* Update T1003.yaml
Add -UseBasicParsing to line 41
* Update T1003.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-12-30 12:08:06 -07:00
bc21f59ff0
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-09-04 00:21:31 +00:00
1513717eb2
Updating atomics to conform to standard ( #1619 )
...
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
2021-09-03 18:20:46 -06:00
4af8bae9f4
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-07-14 17:14:29 +00:00
1f82f6af1f
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-07-14 17:14:23 +00:00
d42bda32a1
Dump svchost.exe to gather RDP plaintext credential ( #1551 )
2021-07-14 11:13:59 -06:00
36d49de4c8
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 17:04:33 +00:00
575b36a8e6
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-24 15:16:54 +00:00
88ad3fd322
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-06-16 18:41:22 +00:00
42799b033d
added TLS/SSL v1.2 enabling commands to any atomic test utilizing IWR ( #1519 )
...
* Update T1204.002.md
Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with
```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12```
* Update T1555.yaml
added line to set ssl/tls version
* Update T1134.001.yaml
updated IWR lines to allow ssl/tls version 1.2
* Update T1069.002.yaml
added lines to every IWR instance to set ssl/tls version to 1.2
* Update T1558.003.yaml
added line to allow TLS/SSL 1.2
* Update T1033.yaml
added command to enable SSL/TLS v1.2
* Update T1055.012.yaml
added command to enable TLS/SSL v1.2
* Update T1115.yaml
Added command to enable SSL/TLS v1.2
* Update T1070.001.yaml
added command enabling SSL/TLS v 1.2
* Update T1564.yaml
added commands to enable SSL/TLS v 1.2
* Update T1566.001.yaml
added command to enable SSL/TLS V1.2
* Update T1135.yaml
added command to enable SSL/TLS v1.2
* Update T1055.yaml
added commands to enable TLS/SSL v 1.2
* Update T1110.003.yaml
added command to enable TLS/SSL v1.2
* Update T1003.yaml
Added command to enable TLS/SSL v1.2
* Update T1053.005.yaml
added command to enable TLS/SSL v1.2
* Update T1003.001.yaml
added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest
* Update T1069.002.yaml
syntax correction
* Update T1134.001.yaml
syntax correction
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2021-06-16 12:41:04 -06:00
058b5c2423
Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci]
2021-03-22 15:39:07 +00:00
92026b8e3c
Moving Invoke-Mimikatz test to T1003.001 ( #1407 )
2021-03-22 09:38:35 -06:00
910a2a764a
Generate docs from job=validate_atomics_generate_docs branch=master
2020-09-29 13:53:28 +00:00
04a409832e
Generate docs from job=validate_atomics_generate_docs branch=master
2020-08-20 20:40:34 +00:00
f7584be904
T1003 NPPSPY GetPrereqs location fix ( #1202 )
...
* Before: NPPSPY is installed into atomics src directories, test
looks for it in the local temp directory resulting in an error.
After: Test is changed to look for NPPSPY directly in atomics src
directory
* Change test to install prereq to local temp directory and work from
there.
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-08-20 14:40:09 -06:00
99a4e8850a
Generate docs from job=validate_atomics_generate_docs branch=master
2020-08-07 17:14:19 +00:00
6165e9e71d
Generate docs from job=validate_atomics_generate_docs branch=master
2020-08-05 00:38:43 +00:00
a001d93114
Generate docs from job=validate_atomics_generate_docs branch=master
2020-07-20 23:42:37 +00:00
139386e8bd
T1003 Creds Dumping with NPPSpy ( #1149 )
...
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-07-20 17:41:47 -06:00
f3799322c7
Generate docs from job=validate_atomics_generate_docs branch=master
2020-07-14 14:51:13 +00:00
f5665eafea
Update T1003.yaml ( #1120 )
...
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-07-14 08:50:50 -06:00
8a82e9b66a
Generate docs from job=validate_atomics_generate_docs branch=master
2020-06-18 01:57:35 +00:00
24549e3866
Convert to Mitre ATT&CK sub-technique schema ( #1056 )
...
* Initial transfer of atomics to MITRE subtechniques
* Add GUIDs back in, attack_technique to string (#1019 )
* technique to string and add guids back in
* technique to string and add guids back in
* technique to string and add guids back in
* technique to string and add guids back in
* Subtechnique transfer T1220-T1546.005 (#1020 )
* Create T1222.001.yaml
* Create T1222.002.yaml
* Create T1505.002.yaml
* Update T1543.003.yaml
* Update AtomicService.cs
* Update T1546.005.yaml
* Delete T1222.yaml
* Update T1482.yaml
* Update T1485.yaml
* Update T1220.yaml
* Update T1489.yaml
* Update T1490.yaml
* Update T1496.yaml
* Update T1505.003.yaml
* Update T1505.yaml
* Update T1518.001.yaml
* Update T1518.yaml
* Update T1529.yaml
* Update T1543.004.yaml
* Update T1546.001.yaml
* Update T1546.002.yaml
* Update T1546.002.yaml
* Update T1546.001.yaml
* Update T1543.004.yaml
* Update T1543.002.yaml
* Update T1543.001.yaml
* Update T1518.001.yaml
* Update T1546.004.yaml
* Update T1546.003.yaml
* Update T1531.yaml
* Update T1222.001.yaml
* Update T1222.002.yaml
* Update T1505.002.yaml
* Update T1505.003.yaml
* Update T1518.001.yaml
* Update T1543.001.yaml
* Update T1546.005.yaml
* Update T1546.004.yaml
* Update T1546.003.yaml
* Update T1546.002.yaml
* Update T1546.001.yaml
* Update T1543.004.yaml
* Update T1543.003.yaml
* Update T1543.002.yaml
* added auto_generated_guid 1220
* added T1222.001 auto_generated_guid
* Update T1222.002.yaml
added auto_generated_guid entries
* Update T1482.yaml
auto_generated_guid added
* Update T1485.yaml
added auto_generated_guids
* Update T1489.yaml
added auto_generated_guids
* Update T1490.yaml
added auto_generated_guids
* Update T1496.yaml
added auto_generated_guid
* Update T1505.002.yaml
added auto_generated_guid from old T1505 same atomic
* Update T1505.003.yaml
added auto_generated_guid from previous atomic 1100
* Delete T1505.yaml
no longer needed, moved to 1505.002
* Update T1518.yaml
added auto_generated_guids
* Update T1529.yaml
added auto_generated_guids
* Update T1531.yaml
added auto_generated_guids
* Update T1543.001.yaml
added auto_generated_guid
* Update T1543.002.yaml
added auto_generated_guid
* Update T1543.004.yaml
added auto_generated_guid
* Update T1546.001.yaml
added auto_generated_guid
* Update T1546.002.yaml
added auto_generated_guid
* Update T1546.003.yaml
* Update T1546.004.yaml
added auto_generated_guid
* Update T1546.005.yaml
added auto_generated_guid
* add guids back in
* fix spacing issue
* fix spacing
* fix spacing
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
* Sub-techniques T1053-T1113 - Updates (#1022 )
* Sub-techniques T1053-T1113 - Updates
Updated techniques for sub-techniques.
* minor fixes
format fixing
* Added GUIDs
- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string
* Sub-technique updates T1546.008 through T1574.011 (#1024 )
* sub technique updates
* sub technique updates
* sub technique updates
* Carrie updates (#1017 )
* updated T1110,12,13
* updated T1114
* updated T1114
* updated T1115
* updated T1119
* updated T1123,24
* updated T1127
* updated T1114
* updated T1127
* updated T1132
* T1134.004
* T1134.004
* updated T1135
* updated T1136
* updated T1137
* updated T1140
* remove depracted T1153
* updated T1176
* updated T1197
* updated T1201
* updated T1202
* updated T1204
* updated T1207
* updated T1216
* updated T1204
* updated T1217
* updated T1218
* updated T1218
* updated T1219
* updated T1218
* attack_technique to string
* Subtechnique transfer (#1025 )
* T1003 review
* T1005 manual review changes
* T1027.002 sub-technique review
* T1027.004 sub-technique review
* T1036 sub-technique review
* T1037 sub-technique review
* T1048 sub-technique review
* YAML bugfixes
* Adding auto-generated GUIDs back to tests
* merging with Mike's PR
* Merging with Carrie's PR
* fix spacing
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
* Subtechnique fix (#1026 )
* add atomic_tests: element
* add atomic_tests: element
* more fixes
* more fixes
* more fixes
* sub technique minor fixes 1 (#1027 )
* fixes
* fixes
* more fixes
* more fixes
* display name fix (#1028 )
* remove some deprecated stuff. reorganize a little (#1031 )
* Gendocs fix (#1033 )
* gendocs updates for subtechniques
* add folders
* ignore auto generated markdown files
* remove tmp files
* add tmp files
* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer
* navigator layer v3.0
* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer
Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com >
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com >
Co-authored-by: Michael Haag <mike@redcanary.com >
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
2020-06-17 12:55:46 -06:00
35c42f2c61
Generate docs from job=validate_atomics_generate_docs branch=master
2020-05-15 17:19:25 +00:00
cbe842b8d8
T1003 pwcollector ( #989 )
...
* T1003 - Chrome Password Collector
* Generate docs from job=validate_atomics_generate_docs branch=T1003-Pwcollector
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-05-14 16:48:14 -06:00
84cad45461
Generate docs from job=validate_atomics_generate_docs branch=master
2020-04-01 14:47:35 +00:00
4937a7c755
added new dump lsass method ( #913 )
2020-04-01 08:46:50 -06:00
51c0b3af71
Generate docs from job=validate_atomics_generate_docs branch=master
2020-03-30 19:09:42 +00:00
b23f570d8a
added Dump LSASS.exe Memory using comsvcs.dll to T1003 ( #912 )
...
* added Dump LSASS.exe Memory using comsvcs.dll
* Updated filemod path
* Re-fixed path.
Co-authored-by: Michael Haag <mike@redcanary.com >
2020-03-30 12:56:59 -06:00
79911e0400
Generate docs from job=validate_atomics_generate_docs branch=master
2020-03-18 13:28:12 +00:00
74e0f641a8
More verbose descriptions to describe what success looks like (plus some little improvements) ( #888 )
...
* corrections to T1002 windows tests
* success descriptions
2020-03-18 07:27:47 -06:00
71223b2514
backslash fix for markdown ( #881 )
2020-03-16 08:50:43 -06:00
6ec7d4bcf0
Specify language for markdown code blocks ( #882 )
...
* specify code block type in markdown
* specify code block type in markdown
2020-03-16 08:46:25 -06:00
3d2c7e0efb
Generate docs from job=validate_atomics_generate_docs branch=master
2020-03-09 21:26:21 +00:00
f3464e311c
Update T1003 ( #865 )
...
* Update T1003
Added prereqs and cleanup commands for test 7 (Offline Credential Theft With Mimikatz)
* Update T1003
Fix typo "...Create the lsass dump ....
2020-03-09 15:24:57 -06:00
5ec79bd8ed
Generate docs from job=validate_atomics_generate_docs branch=master
2020-03-09 15:50:11 +00:00
34f36da8f3
make verifyhash function available to prereq ( #859 )
2020-03-09 09:48:56 -06:00
31f946622d
Generate docs from job=validate_atomics_generate_docs branch=master
2020-03-07 22:20:30 +00:00
291346e52b
Add test 2 prereqs for T1003 that performs Credential Dumping ( #861 )
...
* Add test 2 prereqs for T1003 that performs Credential Dumping
* add import from web
Co-authored-by: Carrie Roberts <clr2of8@gmail.com >
2020-03-07 15:20:14 -07:00
ec50c4b064
Generate docs from job=validate_atomics_generate_docs branch=master
2020-02-26 22:00:47 +00:00
599973ee7a
Generate docs from job=validate_atomics_generate_docs branch=master
2020-02-01 17:36:29 +00:00
bd6e7c0dcf
Pypykatz add dependency ( #817 )
...
* add dependencies to pypykatz tests
* added quotes for the echos and cmd /c
2020-02-01 10:36:16 -07:00
86359ca916
Generate docs from job=validate_atomics_generate_docs branch=master
2020-01-24 16:21:11 +00:00
0189470689
Remove Ninja-Copy test for now ( #793 )
...
* move emond test into correct T#
* only show cleanup with inputs if there are inputs
* remove ninja-copy test for now (broke)
* remove ninja-copy test for now (broke)
Co-authored-by: Tony M Lambert <ForensicITGuy@users.noreply.github.com >
Co-authored-by: Michael Haag <mike@redcanary.com >
2020-01-24 09:20:36 -07:00
8881bdb002
Generate docs from job=validate_atomics_generate_docs branch=master
2020-01-23 03:36:42 +00:00
0dcde71a15
Asynchronous Attack Execution and other handy things ( #790 )
...
* execute attack in separate process
* install from custom repoOwner and branch
* remove zip after install
* added showdetails brief and sleep for linux output
* remove positional param spec
* replacing special PathToAtomicsFolder in commands
* use pwsh on linux
* kill proc tree linux
* include path in remove-item
* update readme
* update readme
* update readme
Co-authored-by: Tony M Lambert <ForensicITGuy@users.noreply.github.com >
2020-01-22 21:36:20 -06:00
a956d4640f
Generate docs from job=validate_atomics_generate_docs branch=master
2020-01-21 18:12:06 +00:00
Atomic Red Team doc generator