security-tools/atomic-red-team

Files

T

Brian Beyer 6eb8f66e51 refactoring into APIs to clean this up

2018-05-11 05:38:02 +02:00

33 KiB

Raw Blame History

persistence

T1156 .bash_profile and .bashrc
T1015 Accessibility Features
T1182 AppCert DLLs
T1103 AppInit DLLs
T1138 Application Shimming
T1131 Authentication Package
T1197 BITS Jobs
T1067 Bootkit
T1176 Browser Extensions
- Atomic Test #1: Chrome (Developer Mode)
- Atomic Test #2: Chrome (Chrome Web Store)
- Atomic Test #3: Firefox
T1042 Change Default File Association
T1109 Component Firmware
T1122 Component Object Model Hijacking
T1136 Create Account
- Atomic Test #1: Create a user account on a Linux system
- Atomic Test #2: Create a user account on a MacOS system
T1038 DLL Search Order Hijacking
T1157 Dylib Hijacking
T1133 External Remote Services
T1044 File System Permissions Weakness
T1158 Hidden Files and Directories
- Atomic Test #1: Create a hidden file in a hidden directory
T1179 Hooking
T1062 Hypervisor
T1183 Image File Execution Options Injection
T1215 Kernel Modules and Extensions
T1161 LC_LOAD_DYLIB Addition
T1177 LSASS Driver
T1159 Launch Agent
T1160 Launch Daemon
T1152 Launchctl
T1168 Local Job Scheduling
T1162 Login Item
T1037 Logon Scripts
T1031 Modify Existing Service
T1128 Netsh Helper DLL
T1050 New Service
T1137 Office Application Startup
T1034 Path Interception
T1150 Plist Modification
T1205 Port Knocking
T1013 Port Monitors
T1163 Rc.common
T1164 Re-opened Applications
T1108 Redundant Access
T1060 Registry Run Keys / Start Folder
T1198 SIP and Trust Provider Hijacking
T1053 Scheduled Task
T1180 Screensaver
T1101 Security Support Provider
T1058 Service Registry Permissions Weakness
T1023 Shortcut Modification
T1165 Startup Items
T1019 System Firmware
T1209 Time Providers
T1154 Trap
T1078 Valid Accounts
T1100 Web Shell
T1084 Windows Management Instrumentation Event Subscription
T1004 Winlogon Helper DLL

defense-evasion

T1134 Access Token Manipulation
T1197 BITS Jobs
T1009 Binary Padding
T1088 Bypass User Account Control
T1191 CMSTP
T1146 Clear Command History
- Atomic Test #1: Clear Bash history (rm)
- Atomic Test #2: Clear Bash history (echo)
- Atomic Test #3: Clear Bash history (cat dev/null)
- Atomic Test #4: Clear Bash history (ln dev/null)
- Atomic Test #5: Clear Bash history (truncate)
- Atomic Test #6: Clear history of a bunch of shells
T1116 Code Signing
T1109 Component Firmware
T1122 Component Object Model Hijacking
T1196 Control Panel Items
T1207 DCShadow
T1038 DLL Search Order Hijacking
T1073 DLL Side-Loading
T1140 Deobfuscate/Decode Files or Information
T1089 Disabling Security Tools
- Atomic Test #1: Disable iptables firewall
- Atomic Test #2: Disable syslog
- Atomic Test #3: Disable Cb Response
- Atomic Test #4: Disable SELinux
T1211 Exploitation for Defense Evasion
T1181 Extra Window Memory Injection
T1107 File Deletion
T1006 File System Logical Offsets
T1144 Gatekeeper Bypass
T1148 HISTCONTROL
T1158 Hidden Files and Directories
- Atomic Test #1: Create a hidden file in a hidden directory
T1147 Hidden Users
T1143 Hidden Window
T1183 Image File Execution Options Injection
T1054 Indicator Blocking
T1066 Indicator Removal from Tools
T1070 Indicator Removal on Host
T1202 Indirect Command Execution
T1130 Install Root Certificate
- Atomic Test #1: Install root CA on CentOS/RHEL
T1118 InstallUtil
T1149 LC_MAIN Hijacking
T1152 Launchctl
T1036 Masquerading
T1112 Modify Registry
T1170 Mshta
T1096 NTFS File Attributes
T1126 Network Share Connection Removal
T1027 Obfuscated Files or Information
T1150 Plist Modification
T1205 Port Knocking
T1186 Process Doppelgänging
T1093 Process Hollowing
T1055 Process Injection
T1108 Redundant Access
T1121 Regsvcs/Regasm
T1117 Regsvr32
T1014 Rootkit
T1085 Rundll32
T1198 SIP and Trust Provider Hijacking
T1064 Scripting
T1218 Signed Binary Proxy Execution
T1216 Signed Script Proxy Execution
T1045 Software Packing
T1151 Space after Filename
T1099 Timestomp
- Atomic Test #1: Set a file's access timestamp
- Atomic Test #2: Set a file's modification timestamp
- Atomic Test #3: Set a file's creation timestamp
T1127 Trusted Developer Utilities
T1078 Valid Accounts
T1102 Web Service

privilege-escalation

discovery

T1087 Account Discovery
- Atomic Test #1: List all accounts
- Atomic Test #2: View sudoers access
- Atomic Test #3: View accounts with UID 0
- Atomic Test #4: List opened files by user
- Atomic Test #5: Show if a user account has ever logger in remotely
T1010 Application Window Discovery
T1217 Browser Bookmark Discovery
T1083 File and Directory Discovery
T1046 Network Service Scanning
- Atomic Test #1: Scan a bunch of ports to see if they are open
T1135 Network Share Discovery
T1201 Password Policy Discovery
T1120 Peripheral Device Discovery
T1069 Permission Groups Discovery
T1057 Process Discovery
T1012 Query Registry
T1018 Remote System Discovery
T1063 Security Software Discovery
T1082 System Information Discovery
T1016 System Network Configuration Discovery
T1049 System Network Connections Discovery
T1033 System Owner/User Discovery
T1007 System Service Discovery
T1124 System Time Discovery

credential-access

execution

lateral-movement

collection

T1123 Audio Capture
- Atomic Test #1: SourceRecorder via Windows command prompt
- Atomic Test #2: PowerShell Cmdlet via Windows command prompt
T1119 Automated Collection
T1115 Clipboard Data
T1074 Data Staged
T1213 Data from Information Repositories
T1005 Data from Local System
T1039 Data from Network Shared Drive
T1025 Data from Removable Media
T1114 Email Collection
T1056 Input Capture
T1185 Man in the Browser
T1113 Screen Capture
T1125 Video Capture

exfiltration

command-and-control

initial-access