Carrie Roberts
24549e3866
* Initial transfer of atomics to MITRE subtechniques * Add GUIDs back in, attack_technique to string (#1019) * technique to string and add guids back in * technique to string and add guids back in * technique to string and add guids back in * technique to string and add guids back in * Subtechnique transfer T1220-T1546.005 (#1020) * Create T1222.001.yaml * Create T1222.002.yaml * Create T1505.002.yaml * Update T1543.003.yaml * Update AtomicService.cs * Update T1546.005.yaml * Delete T1222.yaml * Update T1482.yaml * Update T1485.yaml * Update T1220.yaml * Update T1489.yaml * Update T1490.yaml * Update T1496.yaml * Update T1505.003.yaml * Update T1505.yaml * Update T1518.001.yaml * Update T1518.yaml * Update T1529.yaml * Update T1543.004.yaml * Update T1546.001.yaml * Update T1546.002.yaml * Update T1546.002.yaml * Update T1546.001.yaml * Update T1543.004.yaml * Update T1543.002.yaml * Update T1543.001.yaml * Update T1518.001.yaml * Update T1546.004.yaml * Update T1546.003.yaml * Update T1531.yaml * Update T1222.001.yaml * Update T1222.002.yaml * Update T1505.002.yaml * Update T1505.003.yaml * Update T1518.001.yaml * Update T1543.001.yaml * Update T1546.005.yaml * Update T1546.004.yaml * Update T1546.003.yaml * Update T1546.002.yaml * Update T1546.001.yaml * Update T1543.004.yaml * Update T1543.003.yaml * Update T1543.002.yaml * added auto_generated_guid 1220 * added T1222.001 auto_generated_guid * Update T1222.002.yaml added auto_generated_guid entries * Update T1482.yaml auto_generated_guid added * Update T1485.yaml added auto_generated_guids * Update T1489.yaml added auto_generated_guids * Update T1490.yaml added auto_generated_guids * Update T1496.yaml added auto_generated_guid * Update T1505.002.yaml added auto_generated_guid from old T1505 same atomic * Update T1505.003.yaml added auto_generated_guid from previous atomic 1100 * Delete T1505.yaml no longer needed, moved to 1505.002 * Update T1518.yaml added auto_generated_guids * Update T1529.yaml added auto_generated_guids * Update T1531.yaml added auto_generated_guids * Update T1543.001.yaml added auto_generated_guid * Update T1543.002.yaml added auto_generated_guid * Update T1543.004.yaml added auto_generated_guid * Update T1546.001.yaml added auto_generated_guid * Update T1546.002.yaml added auto_generated_guid * Update T1546.003.yaml * Update T1546.004.yaml added auto_generated_guid * Update T1546.005.yaml added auto_generated_guid * add guids back in * fix spacing issue * fix spacing * fix spacing Co-authored-by: Carrie Roberts <clr2of8@gmail.com> * Sub-techniques T1053-T1113 - Updates (#1022) * Sub-techniques T1053-T1113 - Updates Updated techniques for sub-techniques. * minor fixes format fixing * Added GUIDs - Added GUIDs back - Fixed typo (T1054) - Fixed attack_technique from an array to a string * Sub-technique updates T1546.008 through T1574.011 (#1024) * sub technique updates * sub technique updates * sub technique updates * Carrie updates (#1017) * updated T1110,12,13 * updated T1114 * updated T1114 * updated T1115 * updated T1119 * updated T1123,24 * updated T1127 * updated T1114 * updated T1127 * updated T1132 * T1134.004 * T1134.004 * updated T1135 * updated T1136 * updated T1137 * updated T1140 * remove depracted T1153 * updated T1176 * updated T1197 * updated T1201 * updated T1202 * updated T1204 * updated T1207 * updated T1216 * updated T1204 * updated T1217 * updated T1218 * updated T1218 * updated T1219 * updated T1218 * attack_technique to string * Subtechnique transfer (#1025) * T1003 review * T1005 manual review changes * T1027.002 sub-technique review * T1027.004 sub-technique review * T1036 sub-technique review * T1037 sub-technique review * T1048 sub-technique review * YAML bugfixes * Adding auto-generated GUIDs back to tests * merging with Mike's PR * Merging with Carrie's PR * fix spacing Co-authored-by: Carrie Roberts <clr2of8@gmail.com> * Subtechnique fix (#1026) * add atomic_tests: element * add atomic_tests: element * more fixes * more fixes * more fixes * sub technique minor fixes 1 (#1027) * fixes * fixes * more fixes * more fixes * display name fix (#1028) * remove some deprecated stuff. reorganize a little (#1031) * Gendocs fix (#1033) * gendocs updates for subtechniques * add folders * ignore auto generated markdown files * remove tmp files * add tmp files * Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer * navigator layer v3.0 * Generate docs from job=validate_atomics_generate_docs branch=subtechnique_transfer Co-authored-by: Matt Graeber <60448025+mgraeber-rc@users.noreply.github.com> Co-authored-by: Tsora-Pop <35981510+Tsora-Pop@users.noreply.github.com> Co-authored-by: Michael Haag <mike@redcanary.com> Co-authored-by: CircleCI Atomic Red Team doc generator <email>
25 lines
1011 B
YAML
25 lines
1011 B
YAML
attack_technique: T1552.002
|
|
display_name: 'Unsecured Credentials: Credentials in Registry'
|
|
atomic_tests:
|
|
- name: Enumeration for Credentials in Registry
|
|
auto_generated_guid: b6ec082c-7384-46b3-a111-9a9b8b14e5e7
|
|
description: |
|
|
Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
reg query HKLM /f password /t REG_SZ /s
|
|
reg query HKCU /f password /t REG_SZ /s
|
|
name: command_prompt
|
|
- name: Enumeration for PuTTY Credentials in Registry
|
|
auto_generated_guid: af197fd7-e868-448e-9bd5-05d1bcd9d9e5
|
|
description: |
|
|
Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
|
|
entries are found, they will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s
|
|
name: command_prompt |