atomic-red-team/atomics/Indexes/Indexes-CSV/linux-index.csv

1	Tactic	Technique #	Test #	Test Name
2	persistence	T1156	1	Add command to .bash_profile
3	persistence	T1156	2	Add command to .bashrc
4	persistence	T1176	1	Chrome (Developer Mode)
5	persistence	T1176	2	Chrome (Chrome Web Store)
6	persistence	T1176	3	Firefox
7	persistence	T1136	1	Create a user account on a Linux system
8	persistence	T1136	5	Create a new user in Linux with `root` UID and GID.
9	persistence	T1158	1	Create a hidden file in a hidden directory
10	persistence	T1215	1	Linux - Load Kernel Module via insmod
11	persistence	T1168	1	Cron - Replace crontab with referenced file
12	persistence	T1168	2	Cron - Add script to cron folder
13	persistence	T1168	3	Event Monitor Daemon Persistence
14	persistence	T1166	1	Make and modify binary from C source
15	persistence	T1166	2	Set a SetUID flag on file
16	persistence	T1166	3	Set a SetGID flag on file
17	persistence	T1501	1	Create Systemd Service
18	persistence	T1154	1	Trap
19	impact	T1485	2	macOS/Linux - Overwrite file with DD
20	impact	T1496	1	macOS/Linux - Simulate CPU Load with Yes
21	impact	T1529	3	Restart System via `shutdown` - macOS/Linux
22	impact	T1529	4	Shutdown System via `shutdown` - macOS/Linux
23	impact	T1529	5	Restart System via `reboot` - macOS/Linux
24	impact	T1529	6	Shutdown System via `halt` - Linux
25	impact	T1529	7	Reboot System via `halt` - Linux
26	impact	T1529	8	Shutdown System via `poweroff` - Linux
27	impact	T1529	9	Reboot System via `poweroff` - Linux
28	discovery	T1087	1	Enumerate all accounts
29	discovery	T1087	2	View sudoers access
30	discovery	T1087	3	View accounts with UID 0
31	discovery	T1087	4	List opened files by user
32	discovery	T1087	5	Show if a user account has ever logged in remotely
33	discovery	T1087	6	Enumerate users and groups
34	discovery	T1217	1	List Mozilla Firefox Bookmark Database Files on Linux
35	discovery	T1083	3	Nix File and Diectory Discovery
36	discovery	T1083	4	Nix File and Directory Discovery 2
37	discovery	T1046	1	Port Scan
38	discovery	T1046	2	Port Scan Nmap
39	discovery	T1135	1	Network Share Discovery
40	discovery	T1040	1	Packet Capture Linux
41	discovery	T1201	1	Examine password complexity policy - Ubuntu
42	discovery	T1201	2	Examine password complexity policy - CentOS/RHEL 7.x
43	discovery	T1201	3	Examine password complexity policy - CentOS/RHEL 6.x
44	discovery	T1201	4	Examine password expiration policy - All Linux
45	discovery	T1069	1	Permission Groups Discovery
46	discovery	T1057	1	Process Discovery - ps
47	discovery	T1018	6	Remote System Discovery - arp nix
48	discovery	T1018	7	Remote System Discovery - sweep
49	discovery	T1082	2	System Information Discovery
50	discovery	T1082	3	List OS Information
51	discovery	T1082	4	Linux VM Check via Hardware
52	discovery	T1082	5	Linux VM Check via Kernel Modules
53	discovery	T1082	7	Hostname Discovery
54	discovery	T1016	3	System Network Configuration Discovery
55	discovery	T1049	3	System Network Connections Discovery Linux & MacOS
56	discovery	T1033	2	System Owner/User Discovery
57	credential-access	T1139	1	Search Through Bash History
58	credential-access	T1081	2	Extract passwords with grep
59	credential-access	T1040	1	Packet Capture Linux
60	credential-access	T1145	2	Discover Private SSH Keys
61	credential-access	T1145	3	Copy Private SSH Keys with CP
62	credential-access	T1145	4	Copy Private SSH Keys with rsync
63	defense-evasion	T1009	1	Pad Binary to Change Hash - Linux/macOS dd
64	defense-evasion	T1146	1	Clear Bash history (rm)
65	defense-evasion	T1146	2	Clear Bash history (echo)
66	defense-evasion	T1146	3	Clear Bash history (cat dev/null)
67	defense-evasion	T1146	4	Clear Bash history (ln dev/null)
68	defense-evasion	T1146	5	Clear Bash history (truncate)
69	defense-evasion	T1146	6	Clear history of a bunch of shells
70	defense-evasion	T1090	1	Connection Proxy
71	defense-evasion	T1089	1	Disable iptables firewall
72	defense-evasion	T1089	2	Disable syslog
73	defense-evasion	T1089	3	Disable Cb Response
74	defense-evasion	T1089	4	Disable SELinux
75	defense-evasion	T1107	1	Delete a single file - Linux/macOS
76	defense-evasion	T1107	2	Delete an entire folder - Linux/macOS
77	defense-evasion	T1107	3	Overwrite and delete a file with shred
78	defense-evasion	T1107	8	Delete Filesystem - Linux
79	defense-evasion	T1222	8	chmod - Change file or folder mode (numeric mode)
80	defense-evasion	T1222	9	chmod - Change file or folder mode (symbolic mode)
81	defense-evasion	T1222	10	chmod - Change file or folder mode (numeric mode) recursively
82	defense-evasion	T1222	11	chmod - Change file or folder mode (symbolic mode) recursively
83	defense-evasion	T1222	12	chown - Change file or folder ownership and group
84	defense-evasion	T1222	13	chown - Change file or folder ownership and group recursively
85	defense-evasion	T1222	14	chown - Change file or folder mode ownership only
86	defense-evasion	T1222	15	chown - Change file or folder ownership recursively
87	defense-evasion	T1222	16	chattr - Remove immutable file attribute
88	defense-evasion	T1148	1	Disable history collection
89	defense-evasion	T1148	2	Mac HISTCONTROL
90	defense-evasion	T1158	1	Create a hidden file in a hidden directory
91	defense-evasion	T1070	3	rm -rf
92	defense-evasion	T1070	4	Overwrite Linux Mail Spool
93	defense-evasion	T1070	5	Overwrite Linux Log
94	defense-evasion	T1130	1	Install root CA on CentOS/RHEL
95	defense-evasion	T1036	2	Masquerading as Linux crond process.
96	defense-evasion	T1027	1	Decode base64 Data into Script
97	defense-evasion	T1055	2	Shared Library Injection via /etc/ld.so.preload
98	defense-evasion	T1055	3	Shared Library Injection via LD_PRELOAD
99	defense-evasion	T1014	1	Loadable Kernel Module based Rootkit
100	defense-evasion	T1014	2	Loadable Kernel Module based Rootkit
101	defense-evasion	T1064	1	Create and Execute Bash Shell Script
102	defense-evasion	T1099	1	Set a file's access timestamp
103	defense-evasion	T1099	2	Set a file's modification timestamp
104	defense-evasion	T1099	3	Set a file's creation timestamp
105	defense-evasion	T1099	4	Modify file timestamps using reference file
106	lateral-movement	T1105	1	rsync remote file copy (push)
107	lateral-movement	T1105	2	rsync remote file copy (pull)
108	lateral-movement	T1105	3	scp remote file copy (push)
109	lateral-movement	T1105	4	scp remote file copy (pull)
110	lateral-movement	T1105	5	sftp remote file copy (push)
111	lateral-movement	T1105	6	sftp remote file copy (pull)
112	collection	T1074	2	Stage data from Discovery.sh
113	collection	T1113	3	X Windows Capture
114	collection	T1113	4	Import
115	exfiltration	T1002	3	Data Compressed - nix - zip
116	exfiltration	T1002	4	Data Compressed - nix - gzip Single File
117	exfiltration	T1002	5	Data Compressed - nix - tar Folder or File
118	exfiltration	T1022	1	Data Encrypted with zip and gpg symmetric
119	exfiltration	T1030	1	Data Transfer Size Limits
120	exfiltration	T1048	1	Exfiltration Over Alternative Protocol - SSH
121	exfiltration	T1048	2	Exfiltration Over Alternative Protocol - SSH
122	exfiltration	T1048	3	Exfiltration Over Alternative Protocol - HTTP
123	exfiltration	T1048	5	Exfiltration Over Alternative Protocol - DNS
124	execution	T1059	1	Command-Line Interface
125	execution	T1168	1	Cron - Replace crontab with referenced file
126	execution	T1168	2	Cron - Add script to cron folder
127	execution	T1168	3	Event Monitor Daemon Persistence
128	execution	T1064	1	Create and Execute Bash Shell Script
129	execution	T1153	1	Execute Script using Source
130	execution	T1153	2	Execute Script using Source Alias
131	execution	T1154	1	Trap
132	command-and-control	T1090	1	Connection Proxy
133	command-and-control	T1132	1	Base64 Encoded data.
134	command-and-control	T1105	1	rsync remote file copy (push)
135	command-and-control	T1105	2	rsync remote file copy (pull)
136	command-and-control	T1105	3	scp remote file copy (push)
137	command-and-control	T1105	4	scp remote file copy (pull)
138	command-and-control	T1105	5	sftp remote file copy (push)
139	command-and-control	T1105	6	sftp remote file copy (pull)
140	command-and-control	T1071	3	Malicious User Agents - Nix
141	command-and-control	T1065	2	Testing usage of uncommonly used port
142	privilege-escalation	T1055	2	Shared Library Injection via /etc/ld.so.preload
143	privilege-escalation	T1055	3	Shared Library Injection via LD_PRELOAD
144	privilege-escalation	T1166	1	Make and modify binary from C source
145	privilege-escalation	T1166	2	Set a SetUID flag on file
146	privilege-escalation	T1166	3	Set a SetGID flag on file
147	privilege-escalation	T1169	1	Sudo usage
148	privilege-escalation	T1206	1	Unlimited sudo cache timeout
149	privilege-escalation	T1206	2	Disable tty_tickets for sudo caching