* T1070.003-9 update (get_)prereq_commmand
- moved system changes to the get_prereq(s)
- ubuntu `passwd` didn't accept `--stdin`
- updated get_prereqs for both ubuntu/centos
* T1016 - update prereq
* T1018 - update prereq
* T1562.001 - update rsyslog prereq
* T1560.001 updates dep check/install, update default likely to exist
switch to /var/log/wtmp and /var/log/btmp vs ${HOME}/*.txt, since those will
always be present
tests for zip in the prereq
adds deb/rpm install for zip
* T1486 - update getprereqs
* T1135 - update prereqs
* T1046 - update prereqs
* T1040 - update prereqs
* Update T1070.003.yaml
Added cleanup command to test "Clear and Disable Bash History Logging"
* Update T1070.003.yaml
corrected spacing
* Update T1070.003.yaml
changed echo set -o to a sed replace command
* Update maintainers.md
Remove reference to announcements channel, which has been created.
* Generate docs from job=validate_atomics_generate_docs branch=maintainers-updates
* Update maintainers.md
Updates to maintainers meeting purpose, scope, and agendas.
* Generate docs from job=validate_atomics_generate_docs branch=maintainers-updates
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Update T1070.003.yaml
* Update T1078.001.yaml
* Update T1113.yaml
Remove error from screen when cleaning up for T1113-5
* Update T1197.yaml
Remove error when cleaning up for T1197-4
* Update T1562.001.yaml
Remove error from cleanup of T1562.001-23
* Update T1562.004.yaml
Remove error shown for cleanup of T15262.004-5 and T15262.004-6
* Update T1574.009.yaml
Remove error from cleanup of T1574.009-1
* Update T1553.004.yaml
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* feat: add t1070.003 powershell history clear commands
* feat: include preventing powershell logging
* feat: add cleanup command
* consolidate tests, fix typo
Removed the two duplicated atomics that were using aliases for Remove-Item
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Fix T1551 to T1070
Found that we had T1070 labeled incorrectly as T1551. MITRE pushed a fix for this per https://attack.mitre.org/resources/updates/updates-july-2020/
```
Indicator Removal on Host Was incorrectly re-IDd to T1551, restored to T1070 and its sub-techniques were changed to T1070.001, T1070.002, T1070.003, T1070.004, T1070.005, and T1070.006
```
* Generate MD fix
Attempting to get the MD to generate
* Update enterprise-attack.json
* Generate docs from job=validate_atomics_generate_docs branch=T1070-indicator-removal-fix
Co-authored-by: CircleCI Atomic Red Team doc generator <email>