security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,519 Commits 47 Branches 0 Tags
cd6ed162ebceef98c8d9604ee9ff850b0d39da3d
Commit Graph

3519 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
frack113 cd6ed162eb Add T1564.006 Virtualbox (#1775) 
* Add T1564.006 Virtualbox

* update description

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-12 13:02:22 -07:00
CircleCI Atomic Red Team doc generator b9445cf19e Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-10 14:40:10 +00:00
glallen a83e73fbe4 adds prereq for lsof/T1087.001, fixes other broken prereq cmds (#1774) 
- several instances of: `yum -y epel-release rsyslog` missing an `install`
- adds dependency for lsof
 2022-02-10 07:39:32 -07:00
CircleCI Atomic Red Team doc generator 5f5b2d23d5 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-09 16:57:44 +00:00
CircleCI Atomic Red Team GUID generator ac50cbfaae Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-09 16:57:39 +00:00
Sittikorn S c07e64a941 Rundll32 with Control_RunDLL (#1773) 2022-02-09 09:57:19 -07:00
CircleCI Atomic Red Team doc generator 4f16aad6f9 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-09 15:14:59 +00:00
CircleCI Atomic Red Team GUID generator 0c6399feb1 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-09 15:14:54 +00:00
Clément Notin 54d59022c8 New technique "Create Volume Shadow Copy remotely (WMI) with esentutl" (#1772) 2022-02-09 09:14:25 -06:00
CircleCI Atomic Red Team doc generator 9e92f29f6b Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-08 17:38:57 +00:00
CircleCI Atomic Red Team GUID generator c559c7f176 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-08 17:38:52 +00:00
Michael Haag c600d56ced Rundll32 ordinal (#1770) 2022-02-08 11:38:36 -06:00
CircleCI Atomic Red Team doc generator fa8b76090a Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-08 16:35:03 +00:00
CircleCI Atomic Red Team GUID generator 05248d675d Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-08 16:34:58 +00:00
Leo Verlod 5bcd254baa Adding T1018 Test 15 - DirectorySearcher (#1769) 
* Adding T1018 Test 15 - DirectorySearcher

This test is designed to search for computers within an Active Directory domain through use of the DirectorySearcher .NET class in Powershell.

* small update to description

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-08 10:34:30 -06:00
CircleCI Atomic Red Team doc generator 66db0f61c0 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-08 03:36:52 +00:00
Bhavin Patel 486d16b8fc reverting uuid (#1768) 2022-02-07 21:36:20 -06:00
CircleCI Atomic Red Team doc generator d7042ac308 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 22:00:24 +00:00
CircleCI Atomic Red Team GUID generator 433c20fecb Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 22:00:20 +00:00
Bhavin Patel 1d75fda8df Command and Scripting Interpreter: Bash - 2 new atomics (#1766) 
* AutoSUID exeuction

* updates to rpre reg

* linenum tool

* minor

* uuid

* remove uuid
 2022-02-07 14:59:53 -07:00
CircleCI Atomic Red Team doc generator ccb98851fe Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:33:54 +00:00
CircleCI Atomic Red Team GUID generator 872d256108 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:33:49 +00:00
Leo Verlod 58ecf3b2c0 Adding T1562.001 Test 27 - Disable Defender with Defender Control (#1765) 
* Adding T1562.001 Test 27 - Disable Defender with Defender Control

This test is designed to disable Windows Defender with the "Defender Control" freeware.

* Updating T1562.001 Test 27 for Efficiency

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-07 08:33:33 -07:00
CircleCI Atomic Red Team doc generator da23e1e4b3 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:30:23 +00:00
CircleCI Atomic Red Team GUID generator 0e2c45bc4a Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:30:15 +00:00
Kelsey Seymour 20bb31380d Addition of T1546.015 (#1764) 
* Addition of T1546.015

Details:
Creation of T1546.015 - COM Hijacking

Testing:
W10 Build 19044.1466

Associated Issues:
None found

* Revert "Addition of T1546.015"

This reverts commit c6442f7526f84820ac12f5a3a3934f39dcc98c1d.

* Addition of T1546.015

Details:
Creation of T1546.015 - COM Hijacking

Testing:
W10 Build 19044.1466

Associated Issues:
None found

* Addition of T1546.015

Details:
Creation of T1546.015 - COM Hijacking

Testing:
W10 Build 19044.1466

Associated Issues:
None found

Revert "Addition of T1546.015"

This reverts commit c6442f7526f84820ac12f5a3a3934f39dcc98c1d.

Addition of T1546.015

Details:
Creation of T1546.015 - COM Hijacking

Testing:
W10 Build 19044.1466

Associated Issues:
None found

* Proper DLL

Noticed older version uploaded.  This is the proper one, and matched to AtomicTest.cpp

* update dll url and leave dll on disk

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-07 08:29:34 -07:00
CircleCI Atomic Red Team doc generator 742483f51c Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:05:14 +00:00
CircleCI Atomic Red Team GUID generator 8443011f02 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-07 15:05:09 +00:00
lucasRiley e029a0734d T1036 (#1763) 
* T1036

* Update T1036.yaml

* updated description

* correct outfile param

* Add -force to avoid error msg

* update zip url

Co-authored-by: Riley <lriley@NTI.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-07 08:04:43 -07:00
CircleCI Atomic Red Team doc generator effcf8b023 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-05 02:53:33 +00:00
CircleCI Atomic Red Team GUID generator 3e31df7f38 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-05 02:53:26 +00:00
Rimsha3108 b63dbfa127 T1218.011_update (#1761) 
Co-authored-by: Rimsha Alam <ralam@nti.local>
 2022-02-04 20:52:52 -06:00
CircleCI Atomic Red Team doc generator b5c2dc6f78 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 18:25:24 +00:00
CircleCI Atomic Red Team GUID generator 150b02825d Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 18:25:18 +00:00
Michael Haag 5eecde1f27 DSInternals - Get-ADReplAccount (#1760) 2022-02-04 12:24:57 -06:00
CircleCI Atomic Red Team doc generator 4173795808 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:35:07 +00:00
CircleCI Atomic Red Team GUID generator 883151e2b7 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:35:01 +00:00
frack113 57c097aac0 Add phant0m test (#1759) 
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-04 09:34:34 -06:00
CircleCI Atomic Red Team doc generator 422699b556 Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:23:19 +00:00
CircleCI Atomic Red Team GUID generator 02653f0263 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-04 15:23:13 +00:00
frack113 c9788df1c1 T1555.003 edge (#1758) 
* Add T1555.003 Egde

* fix cleanup
 2022-02-04 09:22:41 -06:00
CircleCI Atomic Red Team doc generator 6835dffd2e Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-03 17:54:53 +00:00
CircleCI Atomic Red Team GUID generator a870578ef4 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-03 17:54:46 +00:00
Bhavin Patel 5f8d08b7db Merge pull request #1748 from WojciechLesicki/master 
T1098 - adding user and service principal to both Azure AD role and Azure role.
 2022-02-03 09:54:23 -08:00
Bhavin Patel 0e0df960e5 Merge branch 'master' into master 2022-02-03 09:52:28 -08:00
CircleCI Atomic Red Team doc generator 454ad2308d Generate docs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-02 16:27:57 +00:00
CircleCI Atomic Red Team GUID generator aeaded3b08 Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2022-02-02 16:27:51 +00:00
nsher07 f9c2a9b69e New Atomic T1543.003 Tiny Turla Backdoor Service w64time (#1756) 
* Update T1543.003.yaml

Atomic - T1045.003 - TinyTurla backdoor service w64time
It's running Dll as service to emulate the tine turla backdoor

* Create W64Time.cpp

* The Dll file for T145.003 Tiny Turla

* Fixed YAML syntax

* add blog link to description

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
 2022-02-02 10:27:20 -06:00
Marrelle Bailey (She/Her) 98c5936be2 Taking out the work covenant (#1754) 
deleting a word from the title
 2022-02-01 10:49:25 -06:00
Wojciech Lesicki cdb8cbe726 Merge branch 'master' into master 2022-02-01 00:50:38 +01:00