security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,225 Commits 47 Branches 0 Tags
979befcf8a9c83cf80aac2900db7c026a41df989
Commit Graph

2225 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
CircleCI Atomic Red Team doc generator 979befcf8a Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 17:44:44 +00:00
JB b3da61d0a4 Improved automation by adding -accepteula option (#1144) 
* added -accepteula flag for PsExec 

will make test seamless and fully automatable
ref https://github.com/redcanaryco/atomic-red-team/issues/1092

* Added reference to making tests not require interaction like -accepteula -q options

* added -accepteula to PsExec command

will make it automated

* Added /accepteula option to Autoruns execution in test 1

prior this may have prevented full automation of the test

* Update spec.yaml

* typo, nice catch cnotin

Co-authored-by: Clément Notin <clement@notin.org>

* fixing mystery text accidentally added to branch (rm'd)

* added -accepteula on psexec test, thanks @cnotin for the catch!

* added back in word, 'manually' removed in last pull acc.

thanks @cnotin

* removing /accepteula proposed previously, from test 1

Co-authored-by: Clément Notin <clement@notin.org>
 2020-07-20 11:44:23 -06:00
CircleCI Atomic Red Team doc generator 5c7b60b218 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 16:17:21 +00:00
P4T12ICK 4836bfd525 T1136.001 new atomics (#1109) 
* new atomic T1136_001

* new atomic T1136_001

* new atomic T1136_001

Co-authored-by: Patrick Bareiss <pbareib@splunk.com>
 2020-07-20 10:17:05 -06:00
CircleCI Atomic Red Team doc generator 4d907c1c8e Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 16:15:36 +00:00
P4T12ICK 55133f23ee Atomics change t1021 001 atc (#1147) 
* atomics T1021 changed

* changes

* changes

* changes

Co-authored-by: Patrick Bareiss <pbareib@splunk.com>
 2020-07-20 10:15:18 -06:00
CircleCI Atomic Red Team doc generator 3d13b787ae Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 15:52:30 +00:00
JB 13397ba910 Directory clean-up (per spec.yaml) pass (#1146) 
* moving shell script file to /src directory to meet spec.yaml

* fixing path to script in test 2 (just moved file in prior commit)

* fixed newline added a few mins ago

* fixed newline

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-20 09:52:14 -06:00
CircleCI Atomic Red Team doc generator e8340a678f Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-20 12:37:27 +00:00
Matt Graeber 1e373f8f6d Merge pull request #1142 from clr2of8/remove-problem-test 
removing problematic test as described in issue 1105
 2020-07-20 08:37:05 -04:00
Matt Graeber 5e90f9a2f1 Merge branch 'master' into remove-problem-test 2020-07-20 08:35:05 -04:00
CircleCI Atomic Red Team doc generator e80f7cfe29 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-18 03:04:26 +00:00
Tsora-Pop 801ff20807 atomic added to T1021.006 (#1116) 
* T1021.006 evil-winrm atomic

* Update T1021.006.yaml

* Update T1021.006.yaml

fixed input args

* Update T1021.006.yaml

added Prereqs for Ruby and moved Evil-WinRM to a Prereq

* Update T1021.006.yaml

removed duplicate description and changed Ctrl + C to exit.

* Updated yaml

updated descriptions for prereqs. removed un-needed "exit" from cleanup_command.

* $env:username replaced

$env:username replaced with $env:Temp to account for when people have who have user profiles in althernative locations than C and also download to TEMP instead of Desktop.

* Removing cleanup_command

Removing cleanup_command as the evil-winrm is a prereq gem. in the future, if a cleanup_prereq_command is implemented this may be worth adding back in(gem uninstall evil-winrm -x).

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 21:03:58 -06:00
CircleCI Atomic Red Team doc generator f59bb10f9f Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 23:52:22 +00:00
bbucao 7c4a0fd25e T1046 Test 3 Nmap Port Scan from Windows (#1133) 
* Update to fix dependency issues

* Update to fix dependency issues

* optimized code

Co-authored-by: Ben Bucao <bbucao@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 17:51:56 -06:00
clr2of8 465476abb3 removing problematic test as described in issue 1105 2020-07-17 15:15:43 -06:00
CircleCI Atomic Red Team doc generator 00ad63fa2a Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 19:58:50 +00:00
Scoubi d1e3ba6991 Update T1555.003.yaml (#1137) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 13:58:10 -06:00
CircleCI Atomic Red Team doc generator 705e7aaadf Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 19:53:05 +00:00
Scoubi 276d32a79d Update T1003.001.yaml (#1138) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 13:52:37 -06:00
CircleCI Atomic Red Team doc generator 2b81b471d8 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 19:50:25 +00:00
Scoubi 15846f1c4a Update T1546.011.yaml (#1139) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 13:50:06 -06:00
CircleCI Atomic Red Team doc generator a2947851d8 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 19:49:09 +00:00
Scoubi eee2765c9d Update T1546.010.yaml (#1140) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string
 2020-07-17 13:48:17 -06:00
CircleCI Atomic Red Team doc generator 126e8b1c05 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 15:15:59 +00:00
Brandon Morgan 0ba89c3b52 Update T1531.yaml (#1132) 
* Update T1531.yaml

initial da account removal commit

* Update T1531.yaml

added dependencies and edited write-host output

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-17 09:15:11 -06:00
CircleCI Atomic Red Team doc generator 5d59fdbce1 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 15:13:28 +00:00
Brandon Morgan 6b04e9421e Update T1003.002.yaml (#1135) 
initial esentutl-copy-sam commit
 2020-07-17 09:12:47 -06:00
CircleCI Atomic Red Team doc generator e8d091ea67 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 13:08:48 +00:00
Matt Graeber 2e56123db3 Merge pull request #1124 from clr2of8/pipe 
correct multi-line yaml indicator
 2020-07-17 09:03:44 -04:00
Matt Graeber 7b6b975054 Merge branch 'master' into pipe 2020-07-17 09:03:01 -04:00
Matt Graeber 785bdcf343 Merge pull request #1114 from redcanaryco/clr2of8-patch-6 
Update description of input argument
 2020-07-17 09:02:52 -04:00
Matt Graeber d46eb469cc Merge branch 'master' into clr2of8-patch-6 2020-07-17 09:01:26 -04:00
Matt Graeber b98da5e2ee Merge branch 'master' into pipe 2020-07-17 09:00:31 -04:00
CircleCI Atomic Red Team doc generator 5b5a60d418 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 01:10:39 +00:00
san-gwea 67e3776d7c T1562 exclude objects (#1131) 
* added a test for evading detection by excluding path from scanning

* added tests for evading process and extesnion scanning

* fixed syntax

* description correction

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-16 19:09:55 -06:00
CircleCI Atomic Red Team doc generator 6ad699f378 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-17 00:12:19 +00:00
san-gwea 3f52420dfe T1087.002 a dfind (#1130) 
* This test uses the ad find tool for reconnaissance in Active directory

* including the src folder
 2020-07-16 18:11:32 -06:00
CircleCI Atomic Red Team doc generator 09c6e7451c Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-16 22:01:44 +00:00
Brandon Morgan 0d12480041 T1018 adidns cmd (#1129) 
* Update T1018.yaml

initial adidnsdump commit

* Update T1018.yaml

update for correct slash in domain\user

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-16 16:01:26 -06:00
Keith McCammon 8297931ae0 No need to shout (#1128) 
* Create new_atomic.md

* Add link to "how to submit a test" docs

* Update new_atomic.md
 2020-07-16 09:10:35 -06:00
Keith McCammon bc8f5c5958 Add link to "how to submit a test" documentation (#1127) 
* Create new_atomic.md

* Add link to "how to submit a test" docs
 2020-07-16 09:07:38 -06:00
Keith McCammon 49d9e27540 Create new_atomic.md (#1123) 2020-07-16 09:00:30 -06:00
CircleCI Atomic Red Team doc generator 72496da590 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-15 20:04:33 +00:00
Danil Karandin 9c42adfa8f T1020 (#1125) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-15 14:03:55 -06:00
clr2of8 0cb2588b37 correct multi-line yaml indicator 2020-07-15 12:51:36 -06:00
Keith McCammon a42a1a6339 Improve issue templates via title prefixes (#1121) 
* Update and rename feature_request.md to idea.md

* Update problem_report.md

* Update website_change.md

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-15 11:38:11 -06:00
CircleCI Atomic Red Team doc generator f3799322c7 Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-14 14:51:13 +00:00
Scoubi f5665eafea Update T1003.yaml (#1120) 
Add a line to include/force TLS1.2 in order for the prereq function to work on win2k16
All the credit to clr2of8 for sending me the string

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2020-07-14 08:50:50 -06:00
CircleCI Atomic Red Team doc generator 9c2c157c3a Generate docs from job=validate_atomics_generate_docs branch=master 2020-07-14 14:49:56 +00:00