Commit Graph

84 Commits

Author SHA1 Message Date
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator 04a409832e Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-20 20:40:34 +00:00
Geoff Galitz f7584be904 T1003 NPPSPY GetPrereqs location fix (#1202)
* Before:  NPPSPY is installed into atomics src directories, test
looks for it in the local temp directory resulting in an error.

After: Test is changed to look for NPPSPY directly in atomics src
directory

* Change test to install prereq to local temp directory and work from
there.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-08-20 14:40:09 -06:00
CircleCI Atomic Red Team doc generator 99a4e8850a Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-07 17:14:19 +00:00
CircleCI Atomic Red Team doc generator 6165e9e71d Generate docs from job=validate_atomics_generate_docs branch=master 2020-08-05 00:38:43 +00:00
CircleCI Atomic Red Team doc generator a001d93114 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 23:42:37 +00:00
Danil Karandin 139386e8bd T1003 Creds Dumping with NPPSpy (#1149)
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-07-20 17:41:47 -06:00
CircleCI Atomic Red Team doc generator f3799322c7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-14 14:51:13 +00:00
Scoubi f5665eafea Update T1003.yaml (#1120)
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-07-14 08:50:50 -06:00
CircleCI Atomic Red Team doc generator 8a82e9b66a Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-18 01:57:35 +00:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056)
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
Michael Haag cbe842b8d8 T1003 pwcollector (#989)
* T1003 - Chrome Password Collector

* Generate docs from job=validate_atomics_generate_docs branch=T1003-Pwcollector

Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-05-14 16:48:14 -06:00
CircleCI Atomic Red Team doc generator 84cad45461 Generate docs from job=validate_atomics_generate_docs branch=master 2020-04-01 14:47:35 +00:00
Carrie Roberts 4937a7c755 added new dump lsass method (#913) 2020-04-01 08:46:50 -06:00
CircleCI Atomic Red Team doc generator 51c0b3af71 Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-30 19:09:42 +00:00
Carrie Roberts b23f570d8a added Dump LSASS.exe Memory using comsvcs.dll to T1003 (#912)
* added Dump LSASS.exe Memory using comsvcs.dll

* Updated filemod path

* Re-fixed path.

Co-authored-by: Michael Haag <mike@redcanary.com>
2020-03-30 12:56:59 -06:00
CircleCI Atomic Red Team doc generator 79911e0400 Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-18 13:28:12 +00:00
Carrie Roberts 74e0f641a8 More verbose descriptions to describe what success looks like (plus some little improvements) (#888)
* corrections to T1002 windows tests

* success descriptions
2020-03-18 07:27:47 -06:00
Carrie Roberts 71223b2514 backslash fix for markdown (#881) 2020-03-16 08:50:43 -06:00
Carrie Roberts 6ec7d4bcf0 Specify language for markdown code blocks (#882)
* specify code block type in markdown

* specify code block type in markdown
2020-03-16 08:46:25 -06:00
CircleCI Atomic Red Team doc generator 3d2c7e0efb Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-09 21:26:21 +00:00
Brian Thacker f3464e311c Update T1003 (#865)
* Update T1003

Added prereqs and cleanup commands for test 7 (Offline Credential Theft With Mimikatz)

* Update T1003

Fix typo "...Create the lsass dump ....
2020-03-09 15:24:57 -06:00
CircleCI Atomic Red Team doc generator 5ec79bd8ed Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-09 15:50:11 +00:00
Carrie Roberts 34f36da8f3 make verifyhash function available to prereq (#859) 2020-03-09 09:48:56 -06:00
CircleCI Atomic Red Team doc generator 31f946622d Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-07 22:20:30 +00:00
Mr B0b 291346e52b Add test 2 prereqs for T1003 that performs Credential Dumping (#861)
* Add test 2 prereqs for T1003 that performs Credential Dumping

* add import from web

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-03-07 15:20:14 -07:00
CircleCI Atomic Red Team doc generator ec50c4b064 Generate docs from job=validate_atomics_generate_docs branch=master 2020-02-26 22:00:47 +00:00
CircleCI Atomic Red Team doc generator 599973ee7a Generate docs from job=validate_atomics_generate_docs branch=master 2020-02-01 17:36:29 +00:00
Brandon Morgan bd6e7c0dcf Pypykatz add dependency (#817)
* add dependencies to pypykatz tests

* added quotes for the echos and cmd /c
2020-02-01 10:36:16 -07:00
CircleCI Atomic Red Team doc generator 86359ca916 Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-24 16:21:11 +00:00
Carrie Roberts 0189470689 Remove Ninja-Copy test for now (#793)
* move emond test into correct T#

* only show cleanup with inputs if there are inputs

* remove ninja-copy test for now (broke)

* remove ninja-copy test for now (broke)

Co-authored-by: Tony M Lambert <ForensicITGuy@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
2020-01-24 09:20:36 -07:00
CircleCI Atomic Red Team doc generator 8881bdb002 Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-23 03:36:42 +00:00
Carrie Roberts 0dcde71a15 Asynchronous Attack Execution and other handy things (#790)
* execute attack in separate process

* install from custom repoOwner and branch

* remove zip after install

* added showdetails brief and sleep for linux output

* remove positional param spec

* replacing special PathToAtomicsFolder in commands

* use pwsh on linux

* kill proc tree linux

* include path in remove-item

* update readme

* update readme

* update readme

Co-authored-by: Tony M Lambert <ForensicITGuy@users.noreply.github.com>
2020-01-22 21:36:20 -06:00
CircleCI Atomic Red Team doc generator a956d4640f Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-21 18:12:06 +00:00
Tony M Lambert a4c9ee4430 Replay the Dependencies Merge (#786)
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* fixing yaml spacing issue

* correcting input name

* rm to del

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-01-21 12:11:45 -06:00
CircleCI Atomic Red Team doc generator caeea44b95 Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-19 05:09:19 +00:00
san-gwea f2fbeb18ed T1003 rm (#778)
* show executor and privilege requirement

* added an atomic to add c2 domain under trusted zoneMap

* corrected typos

* modified adding a domain by creating one the key is not there

* moved registry modification atomic under T1112

* updated local execution file to be current

* corrected typos

* replaced rm by del for tests with executor as command_prompt

* changing rm to del for command_prompt

* Update T1102.yaml

* Update T1112.yaml

my local repo was behind. This file wasn't changed this time.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-01-18 22:09:07 -07:00
CircleCI Atomic Red Team doc generator b98561d215 Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-18 18:41:01 +00:00
Brandon Morgan ef772a3af9 pypykatz registry and LSASS tests (#784)
* pypykatz registry and LSASS tests

* typo fix
2020-01-18 11:40:45 -07:00
Tony M Lambert c3b398e48c Revert "Add Dependencies section to test Yaml and support to use them… (#773)
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"

This reverts commit 511bb87af2.

* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
2020-01-09 09:12:38 -06:00
CircleCI Atomic Red Team doc generator 96edae69d4 Generate docs from job=validate_atomics_generate_docs branch=master 2020-01-09 14:36:26 +00:00
Carrie Roberts 511bb87af2 Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url
2020-01-09 07:36:07 -07:00
CircleCI Atomic Red Team doc generator eac69aa2d9 Generate docs from job=validate_atomics_generate_docs branch=master 2019-12-30 15:19:21 +00:00
Mr B0b fc060f9e92 Improve test 7 (Offline Mimikatz) for T1003 that performs Credential Dumping (#760) 2019-12-30 08:18:57 -07:00
CircleCI Atomic Red Team doc generator f7a918d875 Generate docs from job=validate_atomics_generate_docs branch=master 2019-12-30 15:15:09 +00:00
Mr B0b d587dfbc91 Improve test 5 (ProcDump) for T1003 that performs Credential Dumping (#759) 2019-12-30 08:14:49 -07:00
CircleCI Atomic Red Team doc generator 99a2a8aa31 Generate docs from job=validate_atomics_generate_docs branch=master 2019-12-30 15:11:52 +00:00
Mr B0b 8786bf538b Add cleanup command for test 10 of T1003 that performs Credential Dumping (#758) 2019-12-30 08:11:34 -07:00
Mr B0b 246176fe5d Harmonization of spaces between lines for T1003 that performs Credential Dumping (#756) 2019-12-30 08:09:42 -07:00