fd93a2fe2a
Generate docs from job=validate_atomics_generate_docs branch=master
2019-10-15 00:46:28 +00:00
1ec4ee2afd
fixed loop counter ( #583 )
2019-10-14 18:46:16 -06:00
af26d075f8
Generate docs from job=validate_atomics_generate_docs branch=master
2019-10-08 18:40:28 +00:00
4f98d55d74
T1086 - Added Atomic for writing file in alternate data stream and simulating code execution. ( #582 )
...
* Adding T1086 Alternate Data Stream atomic
* Added newline T1086
2019-10-08 12:40:16 -06:00
f0791ee056
Generate docs from job=validate_atomics_generate_docs branch=master
2019-10-08 18:20:14 +00:00
ca3872b352
fix savertimeout to savetimeout ( #579 )
2019-10-08 12:19:59 -06:00
641a1d027d
Generate docs from job=validate_atomics_generate_docs branch=master
2019-10-08 18:02:00 +00:00
e1f2936764
Update T1038 ( #581 )
...
Swaping on a /c for a /k so the test isnt blocking since this is spawning a new powershell session.
2019-10-08 12:01:35 -06:00
af8e2d4501
Generate docs from job=validate_atomics_generate_docs branch=master
2019-10-08 17:27:21 +00:00
8d5a575af8
Add test for LKM via insmod ( #580 )
2019-10-08 11:27:00 -06:00
25fa6a75e7
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-24 14:36:14 +00:00
9be96cf54f
T1076 rdp to domain controller ( #572 )
...
* Added MacOS and Linux isElevated check [toso: test MacOS]
* Update Invoke-AtomicTest.ps1
* Update Invoke-AtomicTest.ps1
* Update Invoke-AtomicTest.ps1
* T1076 RDP To Domain Controller
2019-09-24 08:36:03 -06:00
0860bb1ec7
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-23 19:01:07 +00:00
247367100b
Added new atomic 'Remote System Discovery - nslookup' + typo fixes ( #576 )
...
Added test 6: Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig. I also formatted the name of this atomic and numbers 1 and 2 to match the others e.g. ("Remote System Discovery - [tool]")
2019-09-23 13:00:44 -06:00
3bc4bf9dd2
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-21 15:21:30 +00:00
d492b8ce4c
Added atomic "Access "unattend.xml," corrected and simplified names of all tests ( #575 )
...
Added a new test that attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored. As well I updated the names of the tests here while keeping them simple; they were duplicated and not descriptive enough.
2019-09-21 09:21:19 -06:00
150ac1ac50
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-21 15:19:44 +00:00
dd95258d4a
T1112 atomic 4 name clarification ( #574 )
...
Details: After further thought & discussion; suggesting a more precise name for atomic 4 (originally pulled here by me). Changing to "Modify registry to store logon credentials," and removing the former word "downgrade." The registry modification in this test does not actually enable a "downgrade," rather it allows the storage of auto-login credentials overall; they are resultingly stored as text, but that is not a downgrade
Testing: no testing required (only name change)
Associated Issues: none
2019-09-21 09:19:34 -06:00
d413ba8f0d
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-19 11:24:18 +00:00
b7ed04ebd7
Fix a bug in T1081 where the macos version of grep is wrongly expected to accept the -P flag and fix a labeling bug in T1201 where a macOS command is wrongly described as a Windows command ( #573 )
2019-09-19 05:24:00 -06:00
7f35271b8e
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 19:17:51 +00:00
a969a01805
Update T1089 - AMSI Bypass ( #570 )
...
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key.
2019-09-17 13:17:34 -06:00
0197987d18
Added MacOS and Linux isElevated check [todo: test MacOS] ( #565 )
...
* Added MacOS and Linux isElevated check [toso: test MacOS]
* Update Invoke-AtomicTest.ps1
* Update Invoke-AtomicTest.ps1
* Update Invoke-AtomicTest.ps1
2019-09-17 13:11:19 -06:00
a226e2aa2e
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 19:09:17 +00:00
cb7b3f4650
Added 'Elevated group enumeration using net group' + minor titles edit ( #567 )
...
* Added 'Elevated group enumeration using net group' + minor fix
added a new atomic ( 4), and updated attack 2 name to more clearly reflect what it is doing versus the newly added atomic (which has commands more specific to high value, elevated groups, and as well simple obfuscation)
* minor syntax fix; description clarification
* further minor clarifications to description and title
2019-09-17 13:09:03 -06:00
a27c73135a
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 18:48:01 +00:00
16cad4ed95
Update T1089 - AMSI Bypass cleanup ( #569 )
...
Adding in a cleanup to set the amsiInitFails variable back to false
2019-09-17 12:47:31 -06:00
d6d68477ac
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 18:33:39 +00:00
26263baec9
New Detection - T1089 ( #568 )
...
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true. This is a simple atomic test that executes this unhooking behavior
2019-09-17 12:33:22 -06:00
1df960f3c4
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 16:44:59 +00:00
edc66092e3
Executor in Atomic Test #2 changed to Powershell ( #504 )
...
The specified test doesn't work in command_prompt.
2019-09-17 09:44:36 -07:00
ff779dd2fb
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-17 14:45:16 +00:00
8b855a5139
Added new atomic, 'Modify registry for password downgrade to plain text' ( #566 )
...
* Added new atomic, 'Modify registry for password downgrade to plain text'
* fixed syntax on executor
2019-09-17 08:44:55 -06:00
ac5fb215d5
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-16 15:09:00 +00:00
29a2fa0539
Added test for deletion of prefetch files (anti-forensic technique) ( #564 )
...
Details: Adding a new atomic for support on 1107, Delete a single prefetch file. Deletion of prefetch files is a known anti-forensic technique. An earlier version of this was drafted by Carrie Roberts (@clr2of8 )
Testing: atomic was tested with success by another jb on Windows 10, powershell with elevated privileges
Associated Issues: will also update the .md page; no issues known
2019-09-16 09:08:43 -06:00
c1d4e22313
update to describe new yaml elements ( #563 )
2019-09-13 15:46:09 -06:00
77d5d88189
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-13 15:42:16 +00:00
eab43d92fb
Update to T1036 ( #562 )
...
Adding in 3 new techniques realted to popular command interpreter renaming / running from non-std paths.
2019-09-13 09:42:01 -06:00
fe2539c7de
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-13 14:00:02 +00:00
971d5c2b8a
Create DLL Hijacking Test - amsi bypass ( #561 )
...
Commiting an AMSI bypass / DLL search order hijacking test.
2019-09-13 07:59:45 -06:00
3c644cc523
installer cleanup ( #560 )
2019-09-12 15:02:29 -06:00
29ad17b01d
Generate docs from job=validate_atomics_generate_docs branch=master
2019-09-07 01:37:43 +00:00
6f2d67e258
pipe command output to nul to keep things clean ( #559 )
2019-09-06 19:37:34 -06:00
30411b7db8
rename InputParameters to InputArgs ( #558 )
2019-09-06 19:36:02 -06:00
3b784d023c
readme updates/fixes ( #557 )
2019-09-06 11:28:13 -06:00
0110ceec98
pipe file creation output to out-null ( #556 )
2019-09-05 17:38:54 -06:00
06c3bb433a
fix null error when using -Cleanup and -ShowDetails ( #555 )
2019-09-05 17:37:48 -06:00
95f2a5ed6f
removing duplicate 'command' element from template ( #550 )
...
* removing duplicate 'command' element from template
* include TODO
2019-09-05 17:36:30 -06:00
91a5f29006
remove Z from Local timestamp ( #554 )
2019-09-05 16:21:09 -06:00
516855f4e7
fix bug where no log output for tests with input parameters ( #553 )
2019-09-05 15:27:39 -06:00
CircleCI Atomic Red Team doc generator