SecurityShrimp
42799b033d
* Update T1204.002.md Added lines to each test using IWR for invoke-webrequest to set the acceptable TLS versions for the commands to complete successfully by prepending the tests with ```[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12``` * Update T1555.yaml added line to set ssl/tls version * Update T1134.001.yaml updated IWR lines to allow ssl/tls version 1.2 * Update T1069.002.yaml added lines to every IWR instance to set ssl/tls version to 1.2 * Update T1558.003.yaml added line to allow TLS/SSL 1.2 * Update T1033.yaml added command to enable SSL/TLS v1.2 * Update T1055.012.yaml added command to enable TLS/SSL v1.2 * Update T1115.yaml Added command to enable SSL/TLS v1.2 * Update T1070.001.yaml added command enabling SSL/TLS v 1.2 * Update T1564.yaml added commands to enable SSL/TLS v 1.2 * Update T1566.001.yaml added command to enable SSL/TLS V1.2 * Update T1135.yaml added command to enable SSL/TLS v1.2 * Update T1055.yaml added commands to enable TLS/SSL v 1.2 * Update T1110.003.yaml added command to enable TLS/SSL v1.2 * Update T1003.yaml Added command to enable TLS/SSL v1.2 * Update T1053.005.yaml added command to enable TLS/SSL v1.2 * Update T1003.001.yaml added commands to enable TLS/SSL v1.2 for any command using invoke-webrequest * Update T1069.002.yaml syntax correction * Update T1134.001.yaml syntax correction Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
Atomic Red Team
Atomic Red Team allows every security team to test their controls by executing simple "atomic tests" that exercise the same techniques used by adversaries (all mapped to Mitre's ATT&CK).
Philosophy
Atomic Red Team is a library of simple tests that every security team can execute to test their controls. Tests are focused, have few dependencies, and are defined in a structured format that can be used by automation frameworks.
Three key beliefs made up the Atomic Red Team charter:
-
Teams need to be able to test everything from specific technical controls to outcomes. Our security teams do not want to operate with a “hopes and prayers” attitude toward detection. We need to know what our controls and program can detect, and what it cannot. We don’t have to detect every adversary, but we do believe in knowing our blind spots.
-
We should be able to run a test in less than five minutes. Most security tests and automation tools take a tremendous amount of time to install, configure, and execute. We coined the term "atomic tests" because we felt there was a simple way to decompose tests so most could be run in a few minutes.
The best test is the one you actually run.
-
We need to keep learning how adversaries are operating. Most security teams don’t have the benefit of seeing a wide variety of adversary types and techniques crossing their desk every day. Even we at Red Canary only come across a fraction of the possible techniques being used, which makes the community working together essential to making us all better.
Having trouble?
Join the community on Slack at https://atomicredteam.slack.com
Getting Started
- Getting Started With Atomic Red Team
- Automated Test Execution with the Execution Frameworks
- Peruse the Complete list of Atomic Tests (md, csv) and the ATT&CK Matrix
- Using ATT&CK Navigator? Check out our coverage layers (All, Windows, MacOS, Linux)
- Fork and Contribute your own modifications
- Have questions? Join the community on Slack at https://atomicredteam.slack.com
- Need a Slack invitation? Submit an invite request via this Google Form
Code of Conduct
In order to have a more open and welcoming community, Atomic Red Team adheres to a code of conduct.
License
See the LICENSE file.