Atomic Red Team doc generator
52 lines
2.4 KiB
YAML
52 lines
2.4 KiB
YAML
attack_technique: T1614
|
|
display_name: System Location Discovery
|
|
atomic_tests:
|
|
- name: Get geolocation info through IP-Lookup services using curl Windows
|
|
auto_generated_guid: fe53e878-10a3-477b-963e-4367348f5af5
|
|
description: |
|
|
Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
ip_lookup_url:
|
|
description: URL of the IP-Lookup service
|
|
type: url
|
|
default: https://ipinfo.io/
|
|
curl_path:
|
|
description: path to curl.exe
|
|
type: path
|
|
default: C:\Windows\System32\Curl.exe
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
Curl must be installed on system.
|
|
prereq_command: |
|
|
if (Test-Path #{curl_path}) {exit 0} else {exit 1}
|
|
get_prereq_command: |
|
|
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
|
Invoke-WebRequest "https://curl.se/windows/dl-8.4.0_6/curl-8.4.0_6-win64-mingw.zip" -Outfile "PathToAtomicsFolder\..\ExternalPayloads\curl.zip"
|
|
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\curl.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\curl"
|
|
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\curl\curl-8.4.0_6-win64-mingw\bin\curl.exe" C:\Windows\System32\Curl.exe
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: false
|
|
command: |
|
|
#{curl_path} -k #{ip_lookup_url}
|
|
- name: Get geolocation info through IP-Lookup services using curl freebsd, linux or macos
|
|
auto_generated_guid: 552b4db3-8850-412c-abce-ab5cc8a86604
|
|
description: |
|
|
Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
|
|
supported_platforms:
|
|
- macos
|
|
- linux
|
|
input_arguments:
|
|
ip_lookup_url:
|
|
description: URL of the IP-Lookup service
|
|
type: url
|
|
default: https://ipinfo.io/
|
|
executor:
|
|
name: bash
|
|
elevation_required: false
|
|
command: |
|
|
curl -k #{ip_lookup_url}
|