security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,345 Commits 47 Branches 0 Tags
761eb9cc72d38474fbb852272ca1fd73dc4e082f
Commit Graph

2345 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
sn0w0tter 761eb9cc72 [OSCD] Create atomic test for T1113 for Windows (#1251) 2020-10-15 10:59:14 -06:00
CircleCI Atomic Red Team doc generator 72e6640db6 Generate docs from job=validate_atomics_generate_docs branch=oscd 2020-10-15 16:51:45 +00:00
mrblacyk f9637403eb T1136.002 - 2 tests added (#1252) 2020-10-15 10:51:21 -06:00
CircleCI Atomic Red Team doc generator c51438c486 Generate docs from job=validate_atomics_generate_docs branch=oscd 2020-10-15 16:42:07 +00:00
mrblacyk dd48a41960 [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253) 
* T1036.004 - 2 tests added

* Update T1036.004.yaml

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-10-15 10:41:21 -06:00
CircleCI Atomic Red Team doc generator d5ef015f53 Generate docs from job=validate_atomics_generate_docs branch=oscd 2020-10-15 16:36:33 +00:00
gregclermont 8e322ecb76 Add test for T1006 Direct Volume Access (#1254) 2020-10-15 10:36:07 -06:00
CircleCI Atomic Red Team doc generator c783bcc9db Generate docs from job=validate_atomics_generate_docs branch=oscd 2020-10-09 19:49:36 +00:00
Carl d5e35e5094 Merge pull request #1246 from haresudhan/T1497.001 
[OSCD] Tests added for T1497.001
 2020-10-09 13:49:11 -06:00
haresudhan 20e73bc883 Merge branch 'T1497.001' of github.com:haresudhan/atomic-red-team into T1497.001 2020-10-09 11:56:16 -06:00
haresudhan 8f5640a24e Changing to device manufacturer based test 2020-10-09 11:56:00 -06:00
CircleCI Atomic Red Team doc generator 06e9a0c56b Generate docs from job=validate_atomics_generate_docs branch=oscd 2020-10-08 17:52:19 +00:00
gregclermont efead2314d Add tests for T1134.001 Access Token Impersonation/Theft (#1236) 2020-10-08 11:51:28 -06:00
Carrie Roberts d17b6dd56e standardize display name 2020-10-08 10:47:41 -06:00
haresudhan 224bdc0d55 Tests added 2020-10-08 09:11:14 -06:00
CircleCI Atomic Red Team doc generator f46f1788ab Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-18 18:45:01 +00:00
dwhite9 d3c575085f removed cleanup command that deletes sharphound so the prereq only needs (#1226) 
to be run once.

Co-authored-by: Daniel White <d0w019h@homeoffice.wal-mart.com>
 2020-09-18 12:44:04 -06:00
CircleCI Atomic Red Team doc generator aaf9b7500e Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-18 14:44:29 +00:00
Matt Graeber 46c29db12f Merge pull request #1225 from cnotin/pr-T1028 
T1028 "Windows Remote Management": split in several techniques
 2020-09-18 10:44:04 -04:00
Clément Notin 749006a557 Fix bis 2020-09-18 16:38:41 +02:00
Clément Notin 9e5d5c5cb2 Fix mistake 2020-09-18 16:38:10 +02:00
cnotin 6000965b1e T1028 "Windows Remote Management": split in several techniques 
Fixes #1042
 2020-09-18 15:57:11 +02:00
CircleCI Atomic Red Team doc generator d68a57842a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-16 13:57:33 +00:00
Matt Graeber 4dc60fe603 Merge pull request #1224 from clr2of8/remove-fp-weakness 
Remove File System Permissions Weakness atomic test
 2020-09-16 09:57:12 -04:00
clr2of8 8fed41ac02 removing test 2020-09-16 07:50:24 -06:00
Amine Taouirsa cebd539a36 Update T1218.011.inf (#1223) 
Convert to Mitre ATT&CK sub-technique schema
 2020-09-16 07:29:43 -06:00
CircleCI Atomic Red Team doc generator 30b77fc5a0 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-15 14:57:15 +00:00
Jil Larner 74ad1849de Changed default computer target from computer1 to localhost in the remote execution through MMC (#1218) 
Co-authored-by: Didier Cambefort <didier.cambefort@scrt.ch>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-15 08:56:52 -06:00
CircleCI Atomic Red Team doc generator 00948b0058 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-15 14:53:29 +00:00
Brian Thacker 7b90e89acd Update T1053.003.yaml (#1221) 
Add code to make cleanup commands.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-15 08:53:11 -06:00
CircleCI Atomic Red Team doc generator 45f59adc44 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-09 16:42:32 +00:00
kpsmiley23 e07e8842ef Update T1106.yaml (#1217) 
Execution doesn't currently work because tmp variable was broken

Tested successfully on a local instance

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-09 10:42:10 -06:00
CircleCI Atomic Red Team doc generator 166da61509 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-09 16:41:01 +00:00
Tsora-Pop eb45d7274c New Test T1562.004 (#1215) 
* New test to allow program through firewall

This test will attempt to allow an executable through the system firewall located in the Users directory

* Create AtomicTestPlaceholder

* AtomicTest executable added for test

* Delete AtomicTestPlaceholder

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-09 10:40:38 -06:00
CircleCI Atomic Red Team doc generator 5277ef9105 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-09 16:35:21 +00:00
Jil Larner 70ad88fe10 T1098 - Added cleanup capability (#1216) 
* Changed Admin Account Manipulate to be able to use Cleanup, as suggested in PR #1201

* Changed Admin Account Manipulate to be able to use Cleanup, as suggested in PR #1201

Co-authored-by: Didier Cambefort <didier.cambefort@scrt.ch>
 2020-09-09 10:35:00 -06:00
CircleCI Atomic Red Team doc generator 115bb861b7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-04 17:21:36 +00:00
Jesse Moore ef53a91332 T1105.002 mp cmd run (#1214) 
* Update T1105.yaml

Add MpCmdRun Windows Defender LOLB

* Update T1105.yaml

Corrected input and yaml spacing

* Update T1105.yaml

Added PreReq exit else
And better description with URL

* Update T1105.yaml

Carrie added enhancements. Thank you Carrie!

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-04 11:21:08 -06:00
CircleCI Atomic Red Team doc generator dcb3d26d84 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-04 17:00:36 +00:00
Jesse Moore 74956c4425 Update T1562.002.yaml (#1213) 
Update T1562.002.yaml with Invoke-Phant0m to Kill Windows Event Log Services Threads.
 2020-09-04 10:59:55 -06:00
CircleCI Atomic Red Team doc generator 77428a9439 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-03 22:20:14 +00:00
Jesse Moore 46e38ff6d1 T1110.002 Hashcat (#1189) 
* T1110.002 Hashcat

T1110.002 Hashcat

* Update to T1110.002.yaml 

Since Hashcat downloads as 7zip I had to do some hacky things to get that to run on the system via $env:temp. I have tested via start-AtomicGUI, the check-prereqs, and GetReqs, Invoke-AtomicTest T1110.002 and the -cleanup command. this should be ready for anyone.

* Added Elevation is required for command

Elevation is Required for the attack command

* updates from Carrie

see comments in PR for details

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-03 16:19:30 -06:00
CircleCI Atomic Red Team doc generator b69f27c2b3 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-03 21:49:12 +00:00
kpsmiley23 730a62b977 Update T1003.002.yaml (#1212) 
Request raw Invoke-PowerDump.ps1 instead of repository page
 2020-09-03 15:48:52 -06:00
CircleCI Atomic Red Team doc generator 04a409832e Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-20 20:40:34 +00:00
Geoff Galitz f7584be904 T1003 NPPSPY GetPrereqs location fix (#1202) 
* Before:  NPPSPY is installed into atomics src directories, test
looks for it in the local temp directory resulting in an error.

After: Test is changed to look for NPPSPY directly in atomics src
directory

* Change test to install prereq to local temp directory and work from
there.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-08-20 14:40:09 -06:00
CircleCI Atomic Red Team doc generator 1411b5ec4a Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-20 20:38:40 +00:00
Laken Harrell 85f4f0ec3f fixed prereq_command (#1205) 
Co-authored-by: Harrell <LHarrell@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-08-20 14:37:47 -06:00
CircleCI Atomic Red Team doc generator 84054abce5 Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-20 20:28:30 +00:00
Brandon Morgan c8be2137d7 T1197 desktopimgdwnldr.exe (#1206) 
* Update T1197.yaml

desktopimgdownldr.exe initial commit

* Update T1197.yaml

fixed parsing issue with command

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-08-20 14:27:09 -06:00