security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,453 Commits 47 Branches 0 Tags
91e0e61c94deabdd44fe731270ad299261c16948
Commit Graph

43 Commits

Author SHA1 Message Date
CircleCI Atomic Red Team doc generator 910a2a764a Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-29 13:53:28 +00:00
CircleCI Atomic Red Team doc generator 115bb861b7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-09-04 17:21:36 +00:00
Jesse Moore ef53a91332 T1105.002 mp cmd run (#1214) 
* Update T1105.yaml

Add MpCmdRun Windows Defender LOLB

* Update T1105.yaml

Corrected input and yaml spacing

* Update T1105.yaml

Added PreReq exit else
And better description with URL

* Update T1105.yaml

Carrie added enhancements. Thank you Carrie!

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-09-04 11:21:08 -06:00
CircleCI Atomic Red Team doc generator 7e4580a1e8 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-08 21:16:22 +00:00
Hare Sudhan Muthusamy 02ac2deb4f Cleanup fixes (#1108) 
* Cleanup Fixes

* Wrong executor name and missing $ sign in T1553

* Cleanup fixes

* File checks added

* File path error check changed
 2020-07-08 15:15:52 -06:00
CircleCI Atomic Red Team doc generator 29a03fd33d Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-19 22:50:36 +00:00
Clément Notin 923a3beeaf T1105: add cleanup to tests 7 & 8 (#1047) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-06-19 16:50:16 -06:00
CircleCI Atomic Red Team doc generator 726677c8a8 Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-19 22:28:22 +00:00
Clément Notin 60f399cdca T1105: fix bitsadmin local_path (#1051) 
Absolute path is required

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-06-19 16:28:03 -06:00
CircleCI Atomic Red Team doc generator 8a82e9b66a Generate docs from job=validate_atomics_generate_docs branch=master 2020-06-18 01:57:35 +00:00
Carrie Roberts 24549e3866 Convert to Mitre ATT&CK sub-technique schema (#1056) 
* Initial transfer of atomics to MITRE subtechniques

* Add GUIDs back in, attack_technique to string (#1019)

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* technique to string and add guids back in

* Subtechnique transfer T1220-T1546.005 (#1020)

* Create T1222.001.yaml

* Create T1222.002.yaml

* Create T1505.002.yaml

* Update T1543.003.yaml

* Update AtomicService.cs

* Update T1546.005.yaml

* Delete T1222.yaml

* Update T1482.yaml

* Update T1485.yaml

* Update T1220.yaml

* Update T1489.yaml

* Update T1490.yaml

* Update T1496.yaml

* Update T1505.003.yaml

* Update T1505.yaml

* Update T1518.001.yaml

* Update T1518.yaml

* Update T1529.yaml

* Update T1543.004.yaml

* Update T1546.001.yaml

* Update T1546.002.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.002.yaml

* Update T1543.001.yaml

* Update T1518.001.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1531.yaml

* Update T1222.001.yaml

* Update T1222.002.yaml

* Update T1505.002.yaml

* Update T1505.003.yaml

* Update T1518.001.yaml

* Update T1543.001.yaml

* Update T1546.005.yaml

* Update T1546.004.yaml

* Update T1546.003.yaml

* Update T1546.002.yaml

* Update T1546.001.yaml

* Update T1543.004.yaml

* Update T1543.003.yaml

* Update T1543.002.yaml

* added auto_generated_guid 1220

* added T1222.001 auto_generated_guid

* Update T1222.002.yaml

added   auto_generated_guid entries

* Update T1482.yaml

  auto_generated_guid added

* Update T1485.yaml

added   auto_generated_guids

* Update T1489.yaml

added   auto_generated_guids

* Update T1490.yaml

added   auto_generated_guids

* Update T1496.yaml

added   auto_generated_guid

* Update T1505.002.yaml

added   auto_generated_guid from old T1505 same atomic

* Update T1505.003.yaml

added  auto_generated_guid from previous atomic 1100

* Delete T1505.yaml

no longer needed, moved to 1505.002

* Update T1518.yaml

added  auto_generated_guids

* Update T1529.yaml

added   auto_generated_guids

* Update T1531.yaml

added   auto_generated_guids

* Update T1543.001.yaml

added   auto_generated_guid

* Update T1543.002.yaml

added   auto_generated_guid

* Update T1543.004.yaml

added   auto_generated_guid

* Update T1546.001.yaml

added   auto_generated_guid

* Update T1546.002.yaml

added   auto_generated_guid

* Update T1546.003.yaml

* Update T1546.004.yaml

added  auto_generated_guid

* Update T1546.005.yaml

added  auto_generated_guid

* add guids back in

* fix spacing issue

* fix spacing

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Sub-techniques T1053-T1113 - Updates (#1022)

* Sub-techniques T1053-T1113 - Updates

Updated techniques for sub-techniques.

* minor fixes

format fixing

* Added GUIDs

- Added GUIDs back
- Fixed typo (T1054)
- Fixed attack_technique from an array to a string

* Sub-technique updates T1546.008 through T1574.011 (#1024)

* sub technique updates

* sub technique updates

* sub technique updates

* Carrie updates (#1017)

* updated T1110,12,13

* updated T1114

* updated T1114

* updated T1115

* updated T1119

* updated T1123,24

* updated T1127

* updated T1114

* updated T1127

* updated T1132

* T1134.004

* T1134.004

* updated T1135

* updated T1136

* updated T1137

* updated T1140

* remove depracted T1153

* updated T1176

* updated T1197

* updated T1201

* updated T1202

* updated T1204

* updated T1207

* updated T1216

* updated T1204

* updated T1217

* updated T1218

* updated T1218

* updated T1219

* updated T1218

* attack_technique to string

* Subtechnique transfer (#1025)

* T1003 review

* T1005 manual review changes

* T1027.002 sub-technique review

* T1027.004 sub-technique review

* T1036 sub-technique review

* T1037 sub-technique review

* T1048 sub-technique review

* YAML bugfixes

* Adding auto-generated GUIDs back to tests

* merging with Mike's PR

* Merging with Carrie's PR

* fix spacing

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

* Subtechnique fix (#1026)

* add atomic_tests: element

* add atomic_tests: element

* more fixes

* more fixes

* more fixes

* sub technique minor fixes 1 (#1027)

* fixes

* fixes

* more fixes

* more fixes

* display name fix (#1028)

* remove some deprecated stuff. reorganize a little (#1031)

* Gendocs fix (#1033)

* gendocs updates for subtechniques

* add folders

* ignore auto generated markdown files

* remove tmp files

* add tmp files

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

* navigator layer v3.0

* Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer

Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com>
Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com>
Co-authored-by: Michael Haag <mike@redcanary.com>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
 2020-06-17 12:55:46 -06:00
CircleCI Atomic Red Team doc generator f1cc467b21 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-20 15:58:43 +00:00
Andrew Beers f8cd169ca3 Move test to T1105 (#1000) 2020-05-20 09:58:20 -06:00
CircleCI Atomic Red Team doc generator 35c42f2c61 Generate docs from job=validate_atomics_generate_docs branch=master 2020-05-15 17:19:25 +00:00
Carrie Roberts 71223b2514 backslash fix for markdown (#881) 2020-03-16 08:50:43 -06:00
Carrie Roberts 6ec7d4bcf0 Specify language for markdown code blocks (#882) 
* specify code block type in markdown

* specify code block type in markdown
 2020-03-16 08:46:25 -06:00
CircleCI Atomic Red Team doc generator 2f778f359e Generate docs from job=validate_atomics_generate_docs branch=master 2020-03-10 23:06:25 +00:00
JrOrOneEquals1 3fa4dd1c9e Fixed cleanup commands (#869) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-03-10 17:06:14 -06:00
CircleCI Atomic Red Team doc generator 723426c15d Generate docs from job=validate_atomics_generate_docs branch=master 2020-02-24 19:30:29 +00:00
blackburnjrb 8762f3f929 Added Test for OSTAP Worming Activity to T1105 (#836) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-02-24 12:29:51 -07:00
CircleCI Atomic Red Team doc generator 73eb6cdd8c Generate docs from job=validate_atomics_generate_docs branch=master 2020-02-06 15:16:46 +00:00
tlor89 cbb1133b91 T1105-Update (#826) 
* Added executor fix cleanup command and Temp local path

* changed local_path variable name

* circleCI syntax error PowerShell

* massage
 2020-02-06 08:16:27 -07:00
Tony M Lambert a4c9ee4430 Replay the Dependencies Merge (#786) 
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url

* fixing yaml spacing issue

* correcting input name

* rm to del

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-01-21 12:11:45 -06:00
Tony M Lambert c3b398e48c Revert "Add Dependencies section to test Yaml and support to use them… (#773) 
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"

This reverts commit 511bb87af2.

* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
 2020-01-09 09:12:38 -06:00
Carrie Roberts 511bb87af2 Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772) 
* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* first draft at dependencies

* lowercase url
 2020-01-09 07:36:07 -07:00
Tony M Lambert 947627a84d T1105 PowerShell download test (#684) 
* T1105 PowerShell download test

* Generate docs from job=validate_atomics_generate_docs branch=t1105-powershell-test
 2019-11-20 15:32:40 -07:00
CircleCI Atomic Red Team doc generator 499c751bcc Generate docs from job=validate_atomics_generate_docs branch=master 2019-09-03 13:36:10 +00:00
Carrie Roberts 1bfefdacfc Add elevated (#542) 
* provide elevation_required attribute

* provide elevation_required attribute

* provide elevation_required attribute
 2019-09-03 07:34:42 -06:00
CircleCI Atomic Red Team doc generator 440e85a9c8 Generate docs from job=validate_atomics_generate_docs branch=master 2019-08-30 15:42:59 +00:00
CircleCI Atomic Red Team doc generator 75c332ac52 Generate docs from job=validate_atomics_generate_docs branch=master 2019-08-29 22:18:28 +00:00
CircleCI Atomic Red Team doc generator 6ff5afc97a Generate docs from job=validate_atomics_generate_docs branch=master 2019-05-31 12:13:54 +00:00
Tony M Lambert b5f1159c4c T1105 Remote File Copy BITSAdmin (#507) 2019-05-31 06:13:40 -06:00
CircleCI Atomic Red Team doc generator a1c83527fb Generate docs from job=validate_atomics_generate_docs branch=master 2019-02-14 06:10:46 +00:00
Keep Watcher 02dc3e41ab Certutil update (#452) 
* Fixing certutil syntax error

* Adding certutil download tests

* Adding commands to rename download for verifyctl argument

* Fixing type syntax
 2019-02-13 22:10:39 -08:00
CircleCI Atomic Red Team doc generator 6965fc15ef Generate docs from job=validate_atomics_generate_docs branch=master 2018-11-14 20:59:18 +00:00
CircleCI Atomic Red Team doc generator 531154eefd Generate docs from job=validate_atomics_generate_docs branch=master 2018-11-10 22:24:33 +00:00
Keith McCammon c2c27aeb71 Merge branch 'master' into t1105-fix 2018-11-10 14:23:53 -07:00
Michael Haag 7bc7660f4f Discovery.bat Update (#397) 
* Discovery and Cleanup

* Generate docs from job=validate_atomics_generate_docs branch=Discovery

* mv discovery.bat

* Fixed Discovery.bat URLs

Updated Techniques with new location of discovery.bat

* Generate docs from job=validate_atomics_generate_docs branch=Discovery
 2018-11-02 13:17:39 -07:00
Tony M Lambert cbb425bdc7 Fixed T1105 test 2018-10-26 12:59:47 -06:00
Brian Beyer 1deb39ba9a Validate command, input_arguments, and TODOs (#383) 
* validate input args in command and vice versa

* validate the existence of TODOs

* Update T1002.yaml

* Update T1014.yaml

* Update T1022.yaml

* Fixed Issues Identified

Fixed multiple issues identified by branch in order to push merge
 2018-10-22 13:10:51 -04:00
Mo Amiri f8230f11bb Changing keywords to match the rest of the atomic test files. Also formating of the files such as --- and capitalising some of the attack_technique values 2018-05-27 15:06:09 +01:00
CircleCI Atomic Red Team doc generator 65fd85dd3c Generate docs from job=validate_atomics_generate_docs branch=uppercase-everything 2018-05-23 23:09:31 +00:00
Brian Beyer 6834971ef7 rename yaml files to capital T 2018-05-23 17:09:04 -06:00