security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,840 Commits 47 Branches 0 Tags
7d311f19f1394de014e2e504a5052128e63351b1
Commit Graph

4624 Commits

Author SHA1 Message Date
Badoodish 7d311f19f1 Update T1562.003.yaml (#2716) 
Corrected the MITRE ATT&CK subtechnique name at top of the file.
Added two new tests for disabling Windows Command Line Auditing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-03-06 13:34:39 -06:00
Raghav_Singh 097ed862cc New Tests: T1001.002 - Data Obfuscation: Steganography (#2695) 
* Create T1001.002.yaml

* Create T1001.002.md

* Update T1001.002.yaml

* Update T1001.002.yaml

* Delete atomics/T1001.002/T1001.002.md

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-03-06 10:42:19 -06:00
Atomic Red Team doc generator 029110b694 Generated docs from job=generate-docs branch=master [ci skip] 2024-03-01 19:23:30 +00:00
Atomic Red Team GUID generator 82729bc3bc Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-03-01 19:23:17 +00:00
jandress 498aecdb83 New test: T1542.001 - 'UEFI Persistence via Wpbbin.exe File Creation' (#2714) 
* New test: T1542.001 - 'UEFI Persistence via Wpbbin.exe File Creation'

* Update T1542.001.yaml

---------

Co-authored-by: jandress <1542666+jandress@users.noreply.github.com>
 2024-03-01 13:22:39 -06:00
Atomic Red Team doc generator de85398163 Generated docs from job=generate-docs branch=master [ci skip] 2024-03-01 17:54:31 +00:00
Zitni Handoo 13937a18f4 Fix T1071.001 Test 2 (#2713) 
Test #2 for T1071.001 is currently not working properly, since the pre-requisite command is incorrect.
This change is to fix the md and yaml files to update the URL for curl
 2024-03-01 11:53:40 -06:00
Atomic Red Team doc generator 11a5b66c38 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-29 01:57:59 +00:00
Atomic Red Team GUID generator f7c26683f5 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-29 01:57:47 +00:00
Leo Verlod 133cc748ff Adding T1134.001 Test 5 - JuicyPotato (#2711) 
* Update T1134.001.yaml

* Update T1134.001.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-28 19:57:14 -06:00
Atomic Red Team doc generator 03aa370b35 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-29 01:53:08 +00:00
Atomic Red Team GUID generator 91a921ee4f Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-29 01:52:56 +00:00
collinmsec 610573612b Update T1120.yaml (#2710) 
* Update T1120.yaml

Added fsutil drive discovery for the technique of Peripheral Device Discovery

* Update T1120.yaml

Made some changes due to error in the workflow

* Update T1120.yaml

Made changes to remove several items

* Update T1120.yaml

Changes made

* Update T1120.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-28 19:52:23 -06:00
Atomic Red Team doc generator 78c918a02e Generated docs from job=generate-docs branch=master [ci skip] 2024-02-29 01:28:02 +00:00
Atomic Red Team GUID generator 07e40226c9 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-29 01:27:49 +00:00
Pattharadanai Sanitjairak aa236952ec Creating new test for T1059 and T1071 (#2708) 
* Adding T1059 and T1071

* Update T1071.md

* Delete atomics/T1071/src directory

* Add files via upload

* change localhost to 127.0.0.1 in T1070.yaml

* Update T1071.md

* Update T1071.md

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-28 19:27:14 -06:00
Atomic Red Team doc generator cc2ac1e0c1 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-29 01:20:49 +00:00
Atomic Red Team GUID generator d017a40f10 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-29 01:20:32 +00:00
Matt Anderson af587464f6 Update T1112.yaml (#2709) 
* Update T1112.yaml

Added Powershell method to modify Wdigest registry setting to store cleartext credentials.

* remove redundant powershell.exe

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-28 19:19:52 -06:00
Atomic Red Team doc generator ef76a8b32c Generated docs from job=generate-docs branch=master [ci skip] 2024-02-26 19:51:20 +00:00
Atomic Red Team GUID generator 344dea9fbd Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-26 19:51:04 +00:00
swathinator 29e3c6eb8f Update RustDesk T1219.yaml (#2706) 
* Update RustDesk T1219.yaml

Update RustDesk T1219

* Update T1219.yaml

* Update T1219.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-26 13:50:20 -06:00
Atomic Red Team doc generator e9b9f2ed7b Generated docs from job=generate-docs branch=master [ci skip] 2024-02-26 15:24:49 +00:00
Atomic Red Team GUID generator c09d2a3748 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-26 15:24:32 +00:00
sai prashanth pulisetti b166507614 Update T1030.yaml Network-Based Data Transfer in Small Chunks (#2658) 
* Update T1030.yaml Network-Based Data Transfer in Small Chunks

# Atomic Test # - T1030 - Data Transfer Size Limits: Network-Based Data Transfer in Small Chunks

## Objective

Simulate the technique of transferring data over a network in small chunks to evade size-based detection mechanisms.

## Description

This test involves transferring data over a network (either to a controlled external endpoint like `example.com`) in small, segmented sizes. This simulates an adversary's behavior in conducting stealthy data exfiltration.

* Update T1030.yaml

* Update T1030.yaml

removed clean up commands and detection

* Update T1030.yaml

* Update T1030.yaml

updated guid

* Update T1030.yaml

* Update T1030.yaml

updated intendents

* Update T1030.yaml

---------

Co-authored-by: Hare Sudhan <code@0x6c.dev>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-26 09:23:55 -06:00
Jake H edea906548 Implementation of venv into Windows Python atomics (#2703) 
* Improve pip handling (#1)

* virtual env added to T1018, tested and confirmed working

* virtual env added to T1003.001, tested and confirmed working

* virtual env added to T1555.003, tested and confirmed working

* Removing pip-autoremove installation as not required

* updating atomics count in README.md [ci skip]

---------

Co-authored-by: Hare Sudhan <code@0x6c.dev>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Co-authored-by: publish bot <opensource@redcanary.com>
 2024-02-26 09:19:26 -06:00
Atomic Red Team doc generator 5aef5da247 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-26 15:17:23 +00:00
Atomic Red Team GUID generator 05fc04f419 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-26 15:17:09 +00:00
chefengineer a09cebd1a3 Adding new test for T1654 for Enumerate Windows Security Log (#2704) 
* Adding new test for T1654 for Enumerate Windows Security Log via WevtUtil

Adding new test for T1654 for Enumerate Windows Security Log via WevtUtil

* Update T1654.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-26 09:16:32 -06:00
Atomic Red Team doc generator ae87c3e185 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-25 01:15:48 +00:00
Atomic Red Team GUID generator 21401622e4 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-25 01:15:31 +00:00
Hare Sudhan bf630ecb29 fix guid error (#2696) 2024-02-24 18:14:49 -07:00
KillrBunn3 1202d62c59 New test: T1218.011 Gamarue tradecraft commandline with rundll32 execution (#2678) 
* New test: T1218.011 Gamarue tradecraft commandline with rundll32 execution

* Update T1218.011.yaml

* Update T1218.011.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-22 15:29:05 -06:00
Daniel Cortez 0bd9b1acc1 New Test T1137.001 - 'Office Application Startup: Office Template Macros.' (#2694) 
* Create T1137.001.yml

Created new Directory and new test for T1137.001

* Rename T1137.001.yml to T1137.001.yaml

* Update T1137.001.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-22 14:56:04 -06:00
jianni20 df24b972a9 New test: T1003.003 - Create Volume Shadow Copy with diskshadow (#2690) 
* New test - Create Volume Shadow Copy with diskshadow

* Fix typos

* fix indentation

* Update T1003.003.yaml

* Update T1003.003.yaml

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-22 14:06:29 -06:00
adelfavero57 eba0f8ea61 Esxi atomic tests batch 2 (#2650) 
* initial esxi commit

* second commit esxi

* use ExternalPayloads folder

* use ExternalPayloads folder

---------

Co-authored-by: clr2of8 <clr2of8@gmail.com>
 2024-02-22 13:48:23 -06:00
Atomic Red Team doc generator 77a44aea50 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-22 17:37:16 +00:00
Atomic Red Team GUID generator ed31f26ba9 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-22 17:37:00 +00:00
Michael Haag 8f71cf4d53 SOAPHound (#2689) 
* SOAPHound

* Updates

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-22 11:36:17 -06:00
Atomic Red Team doc generator a840cf6245 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-21 16:26:59 +00:00
Carrie Roberts af13a59177 remove atomic w/broken bitly link (#2693) 2024-02-21 11:25:36 -05:00
Atomic Red Team doc generator 86c88bc4d1 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-09 14:59:36 +00:00
Atomic Red Team GUID generator 15e983365f Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-09 14:59:20 +00:00
traceflow 50512fcc95 Adding ASR rules deletion (#2683) 
* adding ASR rules deletion

* adding ASR rules deletion

* adding ASR rules deletion

* adding ASR rules deletion

* adding ASR rules deletion

* adding ASR rules deletion

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-09 08:58:45 -06:00
Atomic Red Team doc generator 98f9300887 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-08 21:39:53 +00:00
Atomic Red Team GUID generator ded6414060 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-08 21:39:40 +00:00
Thomas M f92569597a Add new atomic test T1055 custom uuid process injection in C, a stealthier implementation compares to the original one introduced by NCC group (#2674) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-08 15:39:08 -06:00
Atomic Red Team doc generator dea1cd7641 Generated docs from job=generate-docs branch=master [ci skip] 2024-02-08 21:36:56 +00:00
Atomic Red Team GUID generator a9326f2654 Generate GUIDs from job=generate-docs branch=master [skip ci] 2024-02-08 21:36:40 +00:00
Thomas M 18ba41456e T1027.007 Obfuscated Files or Information: Dynamic API Resolution: ninja syscall (#2673) 
* Add new atomic test T1027.007 Obfuscated Files or Information: Dynamic API Resolution

* Add new atomic test T1027.007 Obfuscated Files or Information: Dynamic API Resolution

* Add new atomic test T1027.007 Obfuscated Files or Information: Dynamic API Resolution

* Add new atomic test T1027.007 Obfuscated Files or Information: Dynamic API Resolution

---------

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2024-02-08 15:35:56 -06:00