Atomic Red Team Search / Reference Thing

Description: This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) within an image. The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image file and the tarball file as byte arrays and appends them together to form a new image file. This process effectively embeds the tarball file within the image, utilizing steganography techniques for data obfuscation. This atomic test simulates the technique of data obfuscation via steganography, enabling attackers to clandestinely transfer files across systems undetected. By embedding the tarball file within the image, adversaries can obscure their activities, facilitating covert communication and data exfiltration.

Prereq: Image file must exist

if (!(Test-Path "T1001.002\bin\T1001.002.jpg")) {exit 1} else {
{exit 0}
}

Prereq: File to hide within tarz file must exist

if (!(Test-Path "$env:TEMP\random_passwords.txt")) {exit 1} else {
{exit 0}
}

Prereq: Tarz file to embed in image must exist

if (!(Test-Path "$env:PUBLIC\Downloads\T1001.002.tarz")) {exit 1} else {
{exit 0}
}

Cleanup:

Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "$env:PUBLIC\Downloads\T1001.002New.jpg" -Force -ErrorAction Ignore

Description: This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. The PowerShell script is embedded using steganography techniques, making it undetectable by traditional security measures. The script is hidden within the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems. The test begins by ensuring the availability of the malicious image file and the Extract-Invoke-PSImage script. The test proceeds to extract the hidden PowerShell script (decoded.ps1) from the image file using the Extract-Invoke-PSImage tool. The extracted script is then decoded from base64 encoding and saved as a separate PowerShell (textExtraction.ps1). Consequently, the textExtraction.ps1 script is executed. In the case of this atomic test, the malicious image file which is downloaded has the powershell command Start-Process notepad embedded within in base64. This is done to emulate an attackers behaviour in the case they were to execute malware embedded within the image file.

Prereq: Image file must exist

if (!(Test-Path "T1001.002\bin\evil_kitten.jpg")) {exit 1} else {
{exit 0}
}

Prereq: Extract-Invoke-PSImage must exist

if (!(Test-Path "ExternalPayloads\Extract-Invoke-PSImage.ps1")) {exit 1} else {
{exit 0}
}

Cleanup:

Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\result.ps1" -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\textExtraction.ps1" -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\decoded.ps1" -Force -ErrorAction Ignore

Description: This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system.

Cleanup:

rm "evil_image.jpg"

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp. If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first.

Prereq: ProcDump tool from Sysinternals must exist on disk at specified location (..\ExternalPayloads\procdump.exe)

if (Test-Path "..\ExternalPayloads\procdump.exe") {exit 0} else {exit 1}

Cleanup:

del "C:\Windows\Temp\lsass_dump.dmp" >nul 2> nul

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll. Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.

Cleanup:

Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. https://github.com/outflanknl/Dumpert https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp. If you see a message saying \"The system cannot find the path specified.\", try using the get-prereq_commands to download the tool first.

Prereq: Dumpert executable must exist on disk at specified location (..\ExternalPayloads\Outflank-Dumpert.exe)

if (Test-Path "..\ExternalPayloads\Outflank-Dumpert.exe") {exit 0} else {exit 1}

Cleanup:

del C:\windows\temp\dumpert.dmp >nul 2> nul

Description: The NanoDump tool uses syscalls and an invalid dump signature to avoid detection. https://github.com/helpsystems/nanodump Upon successful execution, you should find the nanondump.dmp file in the temp directory

Prereq: NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)

if (Test-Path ..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}

Cleanup:

del "%temp%\nanodump.dmp" >nul 2> nul

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task Manager and administrative permissions.

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.

Prereq: Mimikatz must exist on disk at specified location (..\ExternalPayloads\x64\mimikatz.exe)

if (Test-Path "..\ExternalPayloads\x64\mimikatz.exe") {exit 0} else {exit 1}

Prereq: Lsass dump must exist at specified location (%tmp%\lsass.DMP)

cmd /c "if not exist %tmp%\lsass.DMP (exit /b 1)"

Description: Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa:: Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test. Successful execution of this test will display multiple usernames and passwords/hashes to the screen. Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.

Prereq: Computer must have python 3 installed

if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Prereq: Computer must have venv configured at ..\ExternalPayloads\venv_t1003_001

if (Test-Path -Path "..\ExternalPayloads\venv_t1003_001") { exit 0 } else { exit 1 }

Prereq: pypykatz must be installed

if (Get-Command "..\ExternalPayloads\venv_t1003_001\Scripts\pypykatz" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Cleanup:

del "%temp%\nanodump.dmp" > nul 2> nul

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure powershell implementation that leverages the MiniDumpWriteDump Win32 API call. Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp. Author of Out-Minidump: Matthew Graeber (@mattifestation)

Cleanup:

Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp. If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the get-prereq_commands to download and install the ProcDump tool first.

Prereq: ProcDump tool from Sysinternals must exist on disk at specified location (..\ExternalPayloads\procdump.exe)

if (Test-Path "..\ExternalPayloads\procdump.exe") {exit 0} else {exit 1}

Cleanup:

del "C:\Windows\Temp\lsass_dump.dmp" >nul 2> nul

Description: Dumps credentials from memory via Powershell by invoking a remote mimikatz script. If Mimikatz runs successfully you will see several usernames and hashes output to the screen. Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"

Description: Use createdump executable from .NET to create an LSASS dump. [Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)

Prereq: .Net v5 must be installed

$exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
if ($exePath -and (Test-Path $exePath)) {exit 0} else {exit 1}

Cleanup:

Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files. Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.

Prereq: Computer must have xordump.exe

if (Test-Path 'C:\Windows\Temp\xordump.exe') {exit 0} else {exit 1}

Cleanup:

Remove-Item C:\Windows\Temp\lsass-xordump.t1003.001.dmp -ErrorAction Ignore

Description: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with lolbin rdrleakdiag.exe. Upon successful execution, you should see the following files created, $env:TEMP\minidump_.dmp and $env:TEMP\results_.hlk.

Cleanup:

Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore

Description: WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process in one of two scenarios; either the process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. The major advantage of this technique is that it does not cause lsass.exe to crash, and since WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides the added advantage of going undetected. WerFault.exe is a process known for dumping every crashing process, from an attacker standpoint this is appealing as their illicit credential extraction will appear benign because from a defender’s viewpoint it’s within the realm of normal activity. Upon successful execution, you should find the dump file in directory of your choice or "%temp%\SilentProcessExit" by default.

Prereq: NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)

if (Test-Path ..\ExternalPayloads\nanodump.x64.exe) {exit 0} else {exit 1}

Cleanup:

rmdir "%temp%\SilentProcessExit" /s /q >nul 2> nul

Description: Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7 Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.

Cleanup:

del %temp%\sam >nul 2> nul
del %temp%\system >nul 2> nul
del %temp%\security >nul 2> nul

Description: Parses registry hives to obtain stored credentials. Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.

Prereq: Computer must have python 3 installed

if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Prereq: Computer must have venv configured at ..\ExternalPayloads\venv_t1003_002

if (Test-Path -Path "..\ExternalPayloads\venv_t1003_002") { exit 0 } else { exit 1 }

Prereq: pypykatz must be installed

if (Get-Command "..\ExternalPayloads\venv_t1003_002\Scripts\pypykatz" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Description: Copy the SAM hive using the esentutl.exe utility This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.

Cleanup:

del %temp%\SAM >nul 2>&1

Description: Executes a hashdump by reading the hashes from the registry.

Prereq: PowerDump script must exist on disk at specified location

if (Test-Path "..\ExternalPayloads\PowerDump.ps1") {exit 0} else {exit 1}

Description: Dump hives from volume shadow copies with the certutil utility, exploiting a vulnerability known as "HiveNightmare" or "SeriousSAM". This can be done with a non-admin user account. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)

Cleanup:

for /L %a in (1,1,10) do @(del %temp%\SAMvss%a >nul 2>&1)

Description: Dump hives from volume shadow copies with System.IO.File. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)

Cleanup:

1..10 | % {
rm "$env:TEMP\SAMvss$_" -ErrorAction Ignore
}

Description: Loot local Credentials - Dump SAM-File for NTLM Hashes technique via function of WinPwn

Description: Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Used reg export to execute this behavior Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.

Cleanup:

del %temp%\sam >nul 2> nul
del %temp%\system >nul 2> nul
del %temp%\security >nul 2> nul

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

Prereq: Target must be a Domain Controller

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy. This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin". A successful test also requires the export of the SYSTEM Registry hive. This test must be executed on a Windows Domain Controller.

Prereq: Target must be a Domain Controller

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT

Prereq: Volume shadow copy must exist

if not exist \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 (exit /b 1)

Prereq: Extract path must exist

if not exist C:\Windows\Temp (exit /b 1)

Cleanup:

del "C:\Windows\Temp\ntds.dit" >nul 2> nul
del "C:\Windows\Temp\VSC_SYSTEM_HIVE" >nul 2> nul
del "C:\Windows\Temp\SYSTEM_HIVE" >nul 2> nul

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of subsequent domain controllers without the need of network-based replication. Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.

Prereq: Target must be a Domain Controller

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT

Cleanup:

rmdir /q /s C:\Windows\Temp\ntds_T1003 >nul 2>&1

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

Prereq: Target must be a Domain Controller

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT

Description: This test is intended to be run from a remote workstation with domain admin context. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

Prereq: Target must be a reachable Domain Controller, and current context must be domain admin

wmic /node:"localhost" shadowcopy list brief

Description: This test is intended to be run from a remote workstation with domain admin context. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy created with esentutl.

Prereq: Target must be a reachable Domain Controller, and current context must be domain admin

wmic /node:"localhost" shadowcopy list brief

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

Description: This test is intended to be run on a domain Controller. The Active Directory database NTDS.dit may be dumped by creating a symlink to Volume Shadow Copy.

Description: This test is intended to be run on a domain controller An alternative to using vssadmin to create a Volume Shadow Copy for extracting ntds.dit

Description: Dump secrets key from Windows registry When successful, the dumped file will be written to $env:Temp\secrets. Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information. https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.

Prereq: PsExec from Sysinternals must exist on disk at specified location (..\ExternalPayloads\T1003.004\bin\PsExec.exe)

if (Test-Path "..\ExternalPayloads\T1003.004\bin\PsExec.exe") {exit 0} else {exit 1}

Cleanup:

del %temp%\secrets >nul 2> nul

Description: This tool allows you to dump Kerberos tickets from the LSA cache. Implemented via Add-Type. If the tool is run as a privileged user, it will automatically obtain NT AUTHORITY\SYSTEM privileges and then dump all tickets. If the tool is run as a non-privileged user, it will only dump tickets from the current logon session. Ref: https://github.com/MzHmO/PowershellKerberos/ Author of dumper.ps1: Michael Zhmaylo (@MzHmO)

Description: List credentials currently stored on the host via the built-in Windows utility cmdkey.exe Credentials listed with Cmdkey only pertain to the current user Passwords will not be displayed once they are stored https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation

Description: Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database. Works against a remote Windows Domain Controller using the replication protocol. Privileges required: domain admin or domain controller account (by default), or any other account with required rights. [Reference](https://adsecurity.org/?p=1729)

Prereq: Mimikatz executor must exist on disk and at specified location (%tmp%\mimikatz\x64\mimikatz.exe)

$mimikatz_path = cmd /c echo %tmp%\mimikatz\x64\mimikatz.exe
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}

Description: The following Atomic will run Get-ADReplAccount from DSInternals. Upon successful execution, domain and credentials will appear in stdout. [Reference](https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/) CrowdStrike StellarParticle. https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/

Prereq: DSInternals must be installed

$RequiredModule = Get-Module -Name DSInternals -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['DSInternals']) {exit 1} else {exit 0}

Description: Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to copy process memory to an external file so it can be searched or exfiltrated later.

Prereq: Script to launch target process must exist

test -f /tmp/T1003.007.sh
grep "T1003.007" /tmp/T1003.007.sh

Cleanup:

rm -f "/tmp/T1003.007.bin"

Description: Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to copy process memory to an external file so it can be searched or exfiltrated later. On FreeBSD procfs must be mounted.

Prereq: Script to launch target process must exist

test -f /tmp/T1003.007.sh
grep "T1003.007" /tmp/T1003.007.sh

Cleanup:

rm -f "/tmp/T1003.007.bin"

Description: Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to copy a process's heap memory to an external file so it can be searched or exfiltrated later. On FreeBSD procfs must be mounted.

Prereq: Script to launch target process must exist

test -f /tmp/T1003.007.sh
grep "T1003.007" /tmp/T1003.007.sh

Prereq: Requires Python

(which python || which python3 || which python2)

Cleanup:

rm -f "/tmp/T1003.007.bin"

Description: MimiPenguin is a tool inspired by MimiKatz that targets Linux systems affected by CVE-2018-20781 (Ubuntu-based distros and certain versions of GNOME Keyring). Upon successful execution on an affected system, MimiPenguin will retrieve passwords from memory and output them to a specified file. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781. See https://www.tecmint.com/mimipenguin-hack-login-passwords-of-linux-users/#:~:text=Mimipenguin%20is%20a%20free%20and,tested%20on%20various%20Linux%20distributions.

Prereq: MimiPenguin script must exist on disk at specified location (/tmp/mimipenguin/mimipenguin_2.0-release/mimipenguin.sh)

if [ -f "/tmp/mimipenguin/mimipenguin_2.0-release/mimipenguin.sh" ]; then exit 0; else exit 1; fi;

Prereq: Strings must be installed

if [ -x "$(command -v strings --version)" ]; then exit 0; else exit 1; fi;

Prereq: Python2 must be installed

if [ -x "$(command -v python2 --version)" ]; then exit 0; else exit 1; fi;

Prereq: Libc-bin must be installed

if [ -x "$(command -v ldd --version)" ]; then exit 0; else exit 1; fi;

Cleanup:

rm -f /tmp/T1003.007Test3.txt > /dev/null

Description: /etc/shadow file is accessed in Linux environments

Cleanup:

rm -f /tmp/T1003.008.txt

Description: /etc/master.passwd file is accessed in FreeBSD environments

Cleanup:

rm -f /tmp/T1003.008.txt

Description: /etc/passwd file is accessed in FreeBSD and Linux environments

Cleanup:

rm -f /tmp/T1003.008.txt

Description: Dump /etc/passwd, /etc/master.passwd and /etc/shadow using ed

Cleanup:

rm -f /tmp/T1003.008.txt

Description: Dump /etc/passwd, /etc/master.passwd and /etc/shadow using sh builtins

Cleanup:

rm -f /tmp/T1003.008.txt

Description: Dump credentials from memory using Gsecdump. Upon successful execution, you should see domain\username's followed by two 32 character hashes. If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus. You will receive only error output if you do not run this test from an elevated context (run as administrator) If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and install Gsecdump first.

Prereq: Gsecdump must exist on disk at specified location (..\ExternalPayloads\gsecdump.exe)

if (Test-Path "..\ExternalPayloads\gsecdump.exe") {exit 0} else {exit 1}

Description: Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy. After user's logging in cleartext password is saved in C:\NPPSpy.txt. Clean up deletes the files and reverses Registry changes. NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy

Prereq: NPPSpy.dll must be available in ExternalPayloads directory

if (Test-Path "..\ExternalPayloads\NPPSPY.dll") {exit 0} else {exit 1}

Cleanup:

$cleanupPath = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$cleanupUpdatedValue = $cleanupPath.PROVIDERORDER
$cleanupUpdatedValue = $cleanupUpdatedValue -replace ',NPPSpy',''
Set-ItemProperty -Path $cleanupPath.PSPath -Name "PROVIDERORDER" -Value $cleanupUpdatedValue
Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy" -Recurse -ErrorAction Ignore
Remove-Item C:\NPPSpy.txt -ErrorAction Ignore
Remove-Item C:\Windows\System32\NPPSpy.dll -ErrorAction Ignore

Description: The svchost.exe contains the RDP plain-text credentials. Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.

Cleanup:

Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore

Description: AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes. [Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)

Prereq: IIS must be installed prior to running the test

if ((Get-WindowsFeature Web-Server).InstallState -eq "Installed") {exit 0} else {exit 1}

Description: AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes. [Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)

Prereq: IIS must be installed prior to running the test

if ((Get-WindowsFeature Web-Server).InstallState -eq "Installed") {exit 0} else {exit 1}

Description: This test executes the exported function `KRShowKeyMgr` located in `keymgr.dll` using `rundll32.exe`. It opens a window that allows to export stored Windows credentials from the credential manager to a file (`.crd` by default). The file can then be retrieved and imported on an attacker-controlled computer to list the credentials get the passwords. The only limitation is that it requires a CTRL+ALT+DELETE input from the attacker, which can be achieve multiple ways (e.g. a custom implant with remote control capabilities, enabling RDP, etc.). Reference: https://twitter.com/0gtweet/status/1415671356239216653

Description: RpcPing command can be used to send an RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. Ref: https://twitter.com/vysecurity/status/974806438316072960

Description: This test searches for files of certain extensions and saves them to a single zip file prior to extraction.

Cleanup:

Remove-Item -Path $outputZip\data.zip -Force

Description: An adversary may know/assume that the user of a system uses sqlite databases which contain interest and sensitive data. In this test we download two databases and a sqlite dump script, then run a find command to find & dump the database content.

Prereq: Check if running on a Debian based machine.

if [ -x "$(command -v sqlite3)" ]; then echo "sqlite3 is installed"; else echo "sqlite3 is NOT installed"; exit 1; fi
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
if [ -x "$(command -v strings)" ]; then echo "strings is installed"; else echo "strings is NOT installed"; exit 1; fi

Cleanup:

rm -f $HOME/.art
rm -f $HOME/gta.db
rm -f $HOME/sqlite_dump.sh

Description: This command will copy Apple Notes database files using AppleScript as seen in Atomic Stealer.

Cleanup:

rm "/private/tmp/NoteStore.sqlite*"

Description: This test uses PowerShell to open a handle on the drive volume via the `\\.\` [DOS device path specifier](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#dos-device-paths) and perform direct access read of the first few bytes of the volume. On success, a hex dump of the first 11 bytes of the volume is displayed. For a NTFS volume, it should correspond to the following sequence ([NTFS partition boot sector](https://en.wikipedia.org/wiki/NTFS#Partition_Boot_Sector_(VBR))): ``` 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 EB 52 90 4E 54 46 53 20 20 20 20 ëR?NTFS ```

Description: Identify system services. Upon successful execution, cmd.exe will execute service commands with expected result to stdout.

Description: Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors. Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.

Cleanup:

del /f /q /s %temp%\service-list.txt >nul 2>&1

Description: Enumerates system service using systemctl/service

Description: Executes the Get-Service cmdlet to gather objects representing all services on the local system.

Description: Compiles and executes C# code to list main window titles associated with each process. Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.

Prereq: T1010.cs must exist on disk at specified location (T1010\src\T1010.cs)

if (Test-Path "T1010\src\T1010.cs") {exit 0} else {exit 1}

Cleanup:

del /f /q /s %TEMP%\T1010.exe >nul 2>&1

Description: Query Windows Registry. Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS). References: https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf

Description: Query Windows Registry with Powershell cmdlets, i.e., Get-Item and Get-ChildItem. The results from above can also be achieved with Get-Item and Get-ChildItem. Unlike using "reg query" which then executes reg.exe, using cmdlets won't generate new processes, which may evade detection systems monitoring process generation.

Description: This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file. An adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. See: https://www.mandiant.com/resources/hunting-com-objects

Cleanup:

remove-item $env:temp\T1592.002Test1.txt -force -erroraction silentlycontinue
remove-item $env:temp\clsids.txt -force -erroraction silentlycontinue

Description: The reg query commands allows to check the status of the AlwaysInstallElevated registry key for both the user and the machine. If both queries return a value of 0x1, then AlwaysInstallElevated is enabled for both user and machine thus allowing a regular user to install a Microsoft Windows Installer package with system level privileges. This can be abused by an attacker to escalate privileges in the host to SYSTEM level.

Description: Microsoft's Software Inventory Logging (SIL) collects information about software installed per host basis. Adversary can use such logs to passively check for existence of software of interest to them. Status of SIL can be checked via registry. [Reference](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/)

Description: The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings. key is.

Description: Loadable Kernel Module based Rootkit

Prereq: The kernel module must exist on disk at specified location (T1014/bin/T1014.ko)

if [ -f T1014/bin/T1014.ko ]; then exit 0; else exit 1; fi;

Cleanup:

sudo rmmod T1014
sudo rm -rf T1014/bin

Description: Loadable Kernel Module based Rootkit

Prereq: The kernel module must exist on disk at specified location (T1014/src/Linux/T1014.ko)

if [ -f /lib/modules/$(uname -r)/T1014.ko ]; then exit 0; else exit 1; fi;

Cleanup:

sudo modprobe -r T1014
sudo rm /lib/modules/$(uname -r)/T1014.ko
sudo depmod -a

Description: Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).

Prereq: The preload library must exist on disk at specified location (/usr/local/lib/libprocesshider.so)

if [ -f /usr/local/lib/libprocesshider.so ]; then exit 0; else exit 1; fi;

Cleanup:

sed -i "\:^/usr/local/lib/libprocesshider.so:d" /etc/ld.so.preload
rm -rf /usr/local/lib/libprocesshider.so /usr/local/bin/evil_script.py /tmp/atomic

Description: Loads Diamorphine kernel module, which hides itself and a processes.

Prereq: The kernel module must exist on disk at specified location (diamorphine.ko)

if [ -f /lib/modules/$(uname -r)/diamorphine.ko ]; then exit 0; else exit 1; fi;

Cleanup:

kill -63 1
sudo modprobe -r diamorphine
sudo rm -rf /lib/modules/$(uname -r)/diamorphine.ko /tmp/atomic
sudo depmod -a

Description: Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS).

Description: Check internet connection using ping on Linux, MACOS. The default target of the ping is 8.8.8.8 (Google Public DNS).

Description: Check internet connection using PowerShell's Test-NetConnection cmdlet and the ICMP/Ping protocol. The default target is 8.8.8.8 (Google Public DNS).

Description: Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound HTTP (Port 80) access. The default target is www.google.com.

Description: Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound SMB (Port 445) access. The default target is 8.8.8.8.

Description: Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present).

Description: Identify network configuration information Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.

Description: Enumerates Windows Firewall Rules using netsh. Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.

Description: Identify network configuration information. Upon successful execution, sh will spawn multiple commands and output will be via stdout.

Prereq: Check if arp command exists on the machine

if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;

Description: Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/ Upon successful execution, cmd.exe will spawn `ipconfig /all`, `net config workstation`, `net view /all /domain`, `nltest /domain_trusts`. Output will be via stdout.

Description: This is to test for what ports are open outbound. The technique used was taken from the following blog: https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/ Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.

Prereq: Test requires T1016\src\top-128.txt to exist

if (Test-Path "T1016\src\top-128.txt") {exit 0} else {exit 1}

Cleanup:

Remove-Item -ErrorAction ignore "$env:USERPROFILE\Desktop\open-ports.txt"

Description: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Prereq: AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

if (Test-Path "..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Description: A list of commands known to be performed by Qakbot for recon purposes

Prereq: File to copy must exist on disk at specified location (T1016\src\qakbot.bat)

if (Test-Path "T1016\src\qakbot.bat") {exit 0} else {exit 1}

Description: "This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows. Using `defaults`, additional arguments can be added to see filtered details, such as `globalstate` for global configuration (\"Is it on or off?\"), `firewall` for common application allow rules, and `explicitauths` for specific rules configured by the user. Using `socketfilterfw`, flags such as --getglobalstate or --listapps can be used for similar filtering. At least one flag is required to send parseable output to standard out.

Description: Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/

Description: Identify remote systems with net.exe. Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.

Description: Identify remote systems with net.exe querying the Active Directory Domain Computers group. Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.

Description: Identify domain controllers for specified domain. Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.

Description: Identify remote systems via ping sweep. Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.

Description: Identify remote systems via arp. Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.

Description: Identify remote systems via arp. Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.

Prereq: Check if arp command exists on the machine

if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;

Description: Identify remote systems via ping sweep. Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.

Description: Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig. Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.

Description: This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test. Successful execution of this test will list dns zones in the terminal.

Prereq: Computer must have python 3 installed

if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Prereq: Computer must have venv configured at ..\ExternalPayloads\venv_t1018

if (Test-Path -Path "..\ExternalPayloads\venv_t1018" ) { exit 0 } else { exit 1 }

Prereq: adidnsdump must be installed

if (Get-Command "..\ExternalPayloads\venv_t1018\Scripts\adidnsdump" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Description: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Prereq: AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

if (Test-Path "..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Description: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Prereq: AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

if (Test-Path "..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Description: Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment.

Prereq: Check if ip command exists on the machine

if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

Description: Use the ip route command to display the kernels routing tables.

Prereq: Check if ip command exists on the machine

if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

Description: Use the netstat command to display the kernels routing tables.

Description: Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses.

Prereq: Check if ip command exists on the machine

if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;

Description: This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain. This test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement. Reference: [Head Fake: Tackling Disruptive Ransomware Attacks](https://www.mandiant.com/resources/head-fake-tackling-disruptive-ransomware-attacks). Upon successful execution, this test will output the names of the computers that reside on the domain to the console window.

Prereq: This PC must be joined to a domain.

if ((Get-WmiObject -Class Win32_ComputerSystem).partofdomain -eq $true) {exit 0} else {exit 1}

Description: The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory. Upon successful execution a listing of Computers will output with their paths in AD. Reference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md

Description: The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory. Upon successful execution a listing of computers will output with their paths in AD. Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/

Description: Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed.

Description: The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers. Upon successful execution a listing of Systems from AD will output with their paths. Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1

Description: Identify remote systems with net.exe querying the Active Directory Domain Controller. Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Controller" in the domain. Output will be via stdout.

Description: This test uses Netscan to identify remote hosts in a specified network range.

Prereq: Netscan must be installed

if (Test-Path "..\ExternalPayloads\netscan\64-bit\netscan.exe") {exit 0} else {exit 1}

Cleanup:

remove-item "$env:temp\T1018NetscanOutput.txt" -force -erroraction silentlycontinue

Description: Creates a text file Tries to upload to a server via HTTP PUT method with ContentType Header Deletes a created file

Cleanup:

$fileName = "C:\temp\T1020_exfilFile.txt"
Remove-Item -Path $fileName -ErrorAction Ignore

Description: Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.

Cleanup:

Remove-Item -Path "C:\temp\T1020__FTP_sample.txt" -ErrorAction Ignore

Description: Attempt an RDP session via Remote Desktop Application to a DomainController.

Prereq: Computer must be domain joined

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) { exit 0} else { exit 1}

Cleanup:

$p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }

Description: Changing RDP Port to Non Standard Port via Powershell

Cleanup:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value 3389
Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction Ignore
Get-Service TermService | Restart-Service -Force -ErrorAction Ignore

Description: Changing RDP Port to Non Standard Port via Command_Prompt

Cleanup:

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3389 /f >nul 2>&1
netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1
net stop TermService /y >nul 2>&1
net start TermService >nul 2>&1

Description: Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ See also: https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/management/enable_rdp.py

Cleanup:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 1 /t REG_DWORD -f >nul 2>&1

Description: Connecting To Remote Shares

Description: Map Admin share utilizing PowerShell

Description: Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).

Prereq: PsExec tool from Sysinternals must exist on disk at specified location (..\ExternalPayloads\PsExec.exe)

if (Test-Path "..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

Description: Executes a command, writing the output to a local Admin Share. This technique is used by post-exploitation frameworks.

Description: Powershell lateral movement using the mmc20 application com object. Reference: https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/ Upon successful execution, cmd will spawn calc.exe on a remote computer.

Description: Powershell lateral movement using the Excel COM objects. Reference: https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922 Upon successful execution, cmd will spawn calc.exe on a remote computer.

Prereq: Microsoft Excel must be installed

try {
New-Object -COMObject "Excel.Application" | Out-Null
Stop-Process -Name "Excel"
exit 0
} catch { exit 1 }

Cleanup:

Remove-Item 'C:\users\admin\AppData\local\Microsoft\WindowsApps\foxprow.exe'

Description: An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.

Prereq: Check if VMWARE PowerCLI PowerShell Module is installed.

$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}

Cleanup:

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server atomic.local -User root -Password pass
Get-VMHostService -VMHost atomic.local | Where-Object {$_.Key -eq "TSM-SSH" } | Stop-VMHostService -Confirm:$false

Description: An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface. [Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)

Prereq: Check if we have plink

if (Test-Path "..\ExternalPayloads\plink.exe") {exit 0} else {exit 1}

Cleanup:

echo "" | "..\ExternalPayloads\plink.exe" -batch "atomic.local" -ssh -l root -pw "password" "vim-cmd hostsvc/disable_ssh"

Description: ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse ARD to gain remote code execution and perform lateral movement. References: https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil

Cleanup:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop -configure -privs -none -quiet

Description: Powershell Enable WinRM Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

Description: Simulate lateral movement with PowerShell Remoting on the local host. Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the local machine as remote target.

Cleanup:

Disable-PSRemoting -Force

Description: An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled

Prereq: Computer must have Ruby Installed

try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}

Prereq: Computer must have Evil-WinRM installed

try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit 1}

Description: This test simulates an attack where PowerShell is used to detect connected USB or other removable storage devices and gather a list of specific document files (e.g., .docx, .xls, .txt, .pdf). The command works by first identifying removable drives on the system and then recursively searching through each one for files matching the targeted extensions. If no removable drives are present, the script will return a message stating that no media is detected. This behavior mimics how adversaries might scan for sensitive documents on removable devices for exfiltration or analysis.

Description: Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash. Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change.

Prereq: The binary must exist on disk at specified location (/tmp/evil-binary)

if [ -f /tmp/evil-binary ]; then exit 0; else exit 1; fi;

Cleanup:

rm /tmp/evil-binary

Description: Uses truncate to add a byte to the binary to change the hash. Upon successful execution, truncate will modify `/tmp/evil-binary`, therefore the expected hash will change.

Prereq: The binary must exist on disk at specified location (/tmp/evil-binary)

if [ -f /tmp/evil-binary ]; then exit 0; else exit 1; fi;

Cleanup:

rm /tmp/evil-binary

Description: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX. No other protection/compression were applied.

Cleanup:

rm /tmp/packed_bin

Description: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX. The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected by some methods, and especially UPX is not able to uncompress it any more.

Cleanup:

rm /tmp/packed_bin

Description: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX. No other protection/compression were applied.

Cleanup:

rm /tmp/packed_bin

Description: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX. The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected by some methods, and especially UPX is not able to uncompress it any more.

Cleanup:

rm /tmp/packed_bin

Description: Compile C# code using csc.exe binary used by .NET Upon execution an exe named T1027.004.exe will be placed in the temp folder

Prereq: C# file must exist on disk at specified location (T1027.004\src\calc.cs)

if (Test-Path "T1027.004\src\calc.cs") {exit 0} else {exit 1}

Cleanup:

del C:\Windows\Temp\T1027.004.exe >nul 2>&1

Description: When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution. The exe file that will be executed is named as T1027.004_DynamicCompile.exe is contained in the 'bin' folder of this atomic, and the source code to the file is in the 'src' folder. Upon execution, the exe will print 'T1027.004 Dynamic Compile'.

Prereq: exe file must exist on disk at specified location (T1027.004\bin\T1027.004_DynamicCompile.exe)

if (Test-Path "T1027.004\bin\T1027.004_DynamicCompile.exe") {exit 0} else {exit 1}

Description: Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.

Prereq: the source file must exist on disk at specified location (T1027.004/src/T1027-004-test.c)

if [ -e T1027.004/src/T1027-004-test.c ]; then exit 0; else exit 1; fi

Description: Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.

Prereq: the source file must exist on disk at specified location (T1027.004/src/T1027-004-test.cc)

if [ -e T1027.004/src/T1027-004-test.cc ]; then exit 0; else exit 1; fi

Description: Compile a go file with golang on FreeBSD, Linux or Macos.

Prereq: the source file must exist on disk at specified location (T1027.004/src/T1027-004-test.go)

if [ -e T1027.004/src/T1027-004-test.go ]; then exit 0; else exit 1; fi

Description: The HTML file will download an ISO file from [T1553.005](https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1553.005/bin/FeelTheBurn.iso) without user interaction. The HTML file is based off of the work from [Stan Hegt](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/)

Prereq: T1027_006_remote.html must exist on disk at specified at PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html

if (Test-Path "T1027.006\bin\T1027_006_Remote.html") { exit 0} else { exit 1}

Cleanup:

$user = [System.Environment]::UserName; Remove-Item -Path C:\Users\$user\Downloads\FeelTheBurn.iso -ErrorAction Ignore

Description: This test calls NtCreateFile via API hashing and dynamic syscall resolution. I have dubbed this particular combination of techniques 'Ninja-syscall'. When successful, a new file named 'hello.log' will be created in the default user's temporary folder, which is a common location for a dropper.

Prereq: Portable Executable to run must exist at specified location (T1027.007\bin\ninja_syscall1.exe)

if (Test-Path "T1027.007\bin\ninja_syscall1.exe") {exit 0} else {exit 1}

Cleanup:

if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }

Description: Decode the eicar value, and write it to file, for AV/EDR to try to catch.

Cleanup:

Just delete the resulting T1027.013_decodedEicar.txt file.

Description: Decrypt the eicar value, and write it to file, for AV/EDR to try to catch.

Cleanup:

Just delete the resulting T1027.013_decryptedEicar.txt file.

Description: Creates a base64-encoded data file and decodes it into an executable shell script Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes `Hello from the Atomic Red Team` and uname -v

Prereq: encode the command into base64 file

if [ -e "/tmp/encoded.dat" ]; then exit 0; else exit 1; fi

Cleanup:

rm /tmp/encoded.dat
rm /tmp/art.sh

Description: Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!"

Description: Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute encoded command and read/write from the registry.

Cleanup:

Remove-ItemProperty -Force -ErrorAction Ignore -Path HKCU:Software\Microsoft\Windows\CurrentVersion -Name Debug

Description: Mimic execution of compressed executable. When successfully executed, calculator.exe will open.

Prereq: T1027.exe must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe

if (Test-Path "..\ExternalPayloads\temp_T1027.zip\T1027.exe") {exit 0} else {exit 1}

Cleanup:

taskkill /f /im calculator.exe >nul 2>nul
taskkill /f /im CalculatorApp.exe >nul 2>nul

Description: Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.

Description: Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.

Description: This is an obfuscated PowerShell command which when executed prints "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.

Description: This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters). Reference: https://wietze.github.io/blog/windows-command-line-obfuscation

Description: The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver. [Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)

Cleanup:

$fileNameToDelete = '04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog'; $filePathToDelete = "$env:windir\registration\"; $fullPathToDelete = Join-Path $filePathToDelete $fileNameToDelete; if (Test-Path $fullPathToDelete) { Remove-Item -Path $fullPathToDelete -Force; Write-Host "File deleted: $fullPathToDelete" } else { Write-Host "File not found: $fullPathToDelete" }

Description: Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/

Prereq: T1027.js must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js

if (Test-Path "..\ExternalPayloads\temp_T1027js.zip\T1027js.js") {exit 0} else {exit 1}

Cleanup:

taskkill /f /im calculator.exe >nul 2>nul

Description: Take a file/directory, split it into 5Mb chunks

Prereq: The file must exist for the test to run.

if [ ! -f /tmp/T1030/T1030_urandom ]; then exit 1; else exit 0; fi;

Cleanup:

if [ -f /tmp/T1030/safe_to_delete ]; then rm -rf /tmp/T1030; fi;

Description: Simulate transferring data over a network in small chunks to evade detection.

Description: Identify System owner or users on an endpoint. Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. Additionally, two files will be written to disk - computers.txt and usernames.txt.

Description: Identify System owner or users on an endpoint Upon successful execution, sh will stdout list of usernames.

Description: Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.

Description: Use the PowerShell environment variables to identify the current logged user.

Cleanup:

Remove-Item -Path .\CurrentactiveUser.txt -Force

Description: Use the PowerShell "GetCurrent" method of the WindowsIdentity .NET class to identify the logged user.

Cleanup:

Remove-Item -Path .\CurrentUserObject.txt -Force

Description: SocGholish performs whoami discovery commands and outputs the results to a tmp file. The test will generate a filename similar to the random one generated during execution and write the file to AppData\Temp. Reference: https://redcanary.com/threat-detection-report/threats/socgholish/

Cleanup:

Remove-Item -Path $env:temp\rad*.tmp -Force

Description: Identify the system owner or current user using native Windows command prompt utilities.

Cleanup:

del $env:temp\\user_info_*.tmp

Description: Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe. Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session

Cleanup:

del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1

Description: Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon. Upon successful execution, sh is renamed to `crond` and executed.

Cleanup:

rm /tmp/crond

Description: Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe. Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.

Cleanup:

del /Q /F %APPDATA%\notepad.exe >nul 2>&1

Description: Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe. Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder

Prereq: Wscript file to execute must exist on disk

if (Test-Path "..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs") {exit 0} else {exit 1}

Cleanup:

del /Q /F %APPDATA%\svchost.exe >nul 2>&1

Description: Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe. Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.

Cleanup:

del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1

Description: Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.

Prereq: Exe file to copy must exist on disk at specified location (T1036.003\bin\T1036.003.exe)

if (Test-Path "T1036.003\bin\T1036.003.exe") {exit 0} else {exit 1}

Cleanup:

Remove-Item ($env:TEMP + "\svchost.exe") -Force -ErrorAction Ignore

Description: Copies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe

Cleanup:

Remove-Item ($env:TEMP + "\svchost.exe") -Force -ErrorAction Ignore

Description: Detect LSM running from an incorrect directory and an incorrect service account This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder. Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.

Cleanup:

del C:\T1036.003.txt >nul 2>&1
del C:\lsm.exe >nul 2>&1

Description: Creating W32Time similar named service (win32times) using schtasks just like threat actor dubbed "Operation Wocao"

Cleanup:

schtasks /tn win32times /delete /f

Description: Creating W32Time similar named service (win32times) using sc just like threat actor dubbed "Operation Wocao"

Cleanup:

sc delete win32times

Description: Runs a C program that calls prctl(PR_SET_NAME) to modify /proc/pid/comm value to "totally_legit". This will show up as process name in simple 'ps' listings.

Prereq: /tmp/T1036_004_prctl_rename must be exist on system.

stat /tmp/T1036_004_prctl_rename

Cleanup:

rm -f /tmp/T1036_004_prctl_rename

Description: Creates a malicious process and hides it by bind mounting to the /proc filesystem of a benign process

Cleanup:

kill $(cat /tmp/evil_pid.txt) || echo "Failed to kill PID $evil_pid"
rm /tmp/evil_pid.txt

Description: Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`)

Cleanup:

rm -f $HOME/.../sh
rmdir $HOME/.../

Description: Launch an executable that attempts to masquerade as a legitimate executable.

Cleanup:

Remove-Item -Path "$Env:windir\Temp\svchost.exe" -ErrorAction Ignore

Description: This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application. The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary. This technique may be used to evade detection by mimicking legitimate software names or locations. **Expected Output:** - A new process named VEDetector.exe appears in the process list, but its behavior matches cmd.exe. - SIEM/EDR systems may detect this as suspicious process activity (e.g., Sysmon Event ID 1 for process creation, or Event ID 13 for registry modifications). - Registry modification in HKLM:\Software\Microsoft\Windows\CurrentVersion\Run may trigger persistence alerts in XDR platforms. **References:** - [MITRE ATT&CK T1036.005](https://attack.mitre.org/techniques/T1036/005/) - [Sysmon Process Creation](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon)

Prereq: The source cmd.exe file must exist on the system.

if (Test-Path "$env:SystemRoot\System32\cmd.exe") { exit 0 } else { exit 1 }

Cleanup:

# Remove registry key
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -ErrorAction SilentlyContinue

# Stop the process
Stop-Process -Name "VEDetector" -Force -ErrorAction SilentlyContinue

# Remove the file
Remove-Item -Path "$env:TEMP\VEDetector.exe" -Force -ErrorAction SilentlyContinue

Write-Host "[+] Cleaned up VEDetector artifacts"

Description: Space After Filename

Description: Space after filename.

Cleanup:

rm -rf /tmp/atomic-test-T1036.006

Description: download and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched. e.g SOME_LEGIT_NAME.[doc,docx,xls,xlsx,pdf,rtf,png,jpg,etc.].[exe,vbs,js,ps1,etc] (Quartelyreport.docx.exe)

Prereq: File to copy must exist on disk at specified location (T1036.007\src\T1036.007_masquerading.vbs)

if (Test-Path "T1036.007\src\T1036.007_masquerading.vbs") {exit 0} else {exit 1}

Prereq: File to copy must exist on disk at specified location (T1036.007\src\T1036.007_masquerading.ps1)

if (Test-Path "T1036.007\src\T1036.007_masquerading.ps1") {exit 0} else {exit 1}

Cleanup:

del /f %temp%\T1036.007_masquerading.docx.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.pdf.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.ps1.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.xls.vbs > nul 2>&1
del /f %temp%\T1036.007_masquerading.xlsx.vbs > nul 2>&1
del /f %temp%\T1036.007_masquerading.png.vbs > nul 2>&1
del /f %temp%\T1036.007_masquerading.doc.ps1 > nul 2>&1
del /f %temp%\T1036.007_masquerading.pdf.ps1 > nul 2>&1
del /f %temp%\T1036.007_masquerading.rtf.ps1 > nul 2>&1

Description: It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.

Cleanup:

remove-item "$env:allusersprofile\cmd.exe" -force -erroraction silentlycontinue

Description: When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique [as reported here](https://twitter.com/ffforward/status/1481672378639912960)

Prereq: Zip file must be present.

if (Test-Path "..\ExternalPayloads\T1036.zip") {exit 0} else {exit 1}

Cleanup:

taskkill /IM Calculator.exe /f >$null 2>$null
Remove-Item "$env:userprofile\Downloads\T1036" -recurse -ErrorAction Ignore

Description: Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key that can be viewed in the Registry Editor.

Cleanup:

REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
del %temp%\art.bat >nul 2>&1
del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1

Description: Mac logon script

Description: Modify rc.common [Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)

Description: Modify rc.common

Cleanup:

origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi

Description: Modify rc.local

Cleanup:

origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi

Description: Modify or create an file in /Library/StartupItems [Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)

Cleanup:

sudo rm /Library/StartupItems/EvilStartup.plist

Description: Add launch script to /Library/StartupItems to launch agent [Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)

Prereq: /Library/StartupItems must exist

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Prereq: The shared library must exist on disk at specified location ($T1037.005/src/T1037_005_daemon.plist)

if [ -f $T1037.005/src/T1037_005_daemon.plist ]; then exit 0; else exit 1; fi;

Prereq: The startup script must exist on disk at specified location ($T1037.005/src/T1037.005_daemon.sh)

if [ -f $T1037.005/src/T1037.005_daemon.sh ]; then exit 0; else exit 1; fi;

Cleanup:

sudo launchctl unload /tmp/T1037_005_daemon.plist
sudo rm /tmp/T1037_005_daemon.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_daemon.txt

Description: Add launch script to /Library/StartupItems to launch agent [Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)

Prereq: /Library/StartupItems must exist

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Prereq: The shared library must exist on disk at specified location ($T1037.005/src/T1037_005_agent.plist)

if [ -f $T1037.005/src/T1037_005_agent.plist ]; then exit 0; else exit 1; fi;

Prereq: The startup script must exist on disk at specified location ($T1037.005/src/T1037.005_agent.sh)

if [ -f $T1037.005/src/T1037.005_agent.sh ]; then exit 0; else exit 1; fi;

Cleanup:

sudo launchctl unload /tmp/T1037_005_agent.plist
sudo rm /tmp/T1037_005_agent.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_agent.txt

Description: Copy from sensitive File from the c$ of another LAN computer with copy cmd https://twitter.com/SBousseaden/status/1211636381086339073

Prereq: Administrative share must exist on 127.0.0.1

if (Test-Path "\\127.0.0.1\C$") {exit 0} else {exit 1}

Prereq: "\\127.0.0.1\C$\Windows\temp\Easter_Bunny.password" must exist on 127.0.0.1

if (Test-Path "\\127.0.0.1\C$\Windows\temp\Easter_Bunny.password") {exit 0} else {exit 1}

Cleanup:

del \\127.0.0.1\C$\Windows\temp\Easter_Bunny.password
del %TEMP%\Easter_egg.password

Description: Copy from sensitive File from the c$ of another LAN computer with powershell https://twitter.com/SBousseaden/status/1211636381086339073

Prereq: Administrative share must exist on 127.0.0.1

if (Test-Path "\\127.0.0.1\C$") {exit 0} else {exit 1}

Prereq: "\\127.0.0.1\C$\Windows\temp\Easter_Bunny.password" must exist on 127.0.0.1

if (Test-Path "\\127.0.0.1\C$\Windows\temp\Easter_Bunny.password") {exit 0} else {exit 1}

Cleanup:

Remove-Item -Path "\\127.0.0.1\C$\Windows\temp\Easter_Bunny.password"
Remove-Item -Path "$Env:TEMP\Easter_egg.password"

Description: Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed. Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.

Prereq: Check if at least one of tcpdump or tshark is installed.

if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;

Description: Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed. Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.

Prereq: Check if at least one of tcpdump or tshark is installed.

if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;

Description: Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed. Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.

Prereq: Check if at least one of tcpdump or tshark is installed.

if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;

Description: Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark installed. Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".

Prereq: tshark must be installed and in the default path of "c:\Program Files\Wireshark\Tshark.exe".

if (test-path "c:\program files\wireshark\tshark.exe") {exit 0} else {exit 1}

Prereq: npcap must be installed.

if (test-path "C:\Program Files\Npcap\npcap.sys") {exit 0} else {exit 1}

Description: Uses the built-in Windows packet capture After execution you should find a file named trace.etl and trace.cab in the temp directory

Cleanup:

netsh trace stop >nul 2>&1
TIMEOUT /T 5 >nul 2>&1
del %temp%\trace.etl >nul 2>&1
del %temp%\trace.cab >nul 2>&1

Description: Will start a packet capture and store log file as t1040.etl. https://lolbas-project.github.io/lolbas/Binaries/Pktmon/

Cleanup:

del %TEMP%\t1040.etl

Description: Select Desired ports for packet capture https://lolbas-project.github.io/lolbas/Binaries/Pktmon/

Cleanup:

pktmon filter remove

Description: Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.

Prereq: compile C program

exit 1

Cleanup:

rm -f /tmp/t1040_macos_pcapdemo

Description: Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.

Prereq: compile C program

exit 1

Cleanup:

rm -f /tmp/t1040_macos_pcapdemo

Description: Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.

Prereq: compile C program

exit 1

Cleanup:

rm -f /tmp/t1040_freebsd_pcapdemo

Description: Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.

Prereq: compile C program

exit 1

Cleanup:

rm -f /tmp/t1040_freebsd_pcapdemo

Description: Captures packets with domain=AF_PACKET, type=SOCK_RAW for a few seconds.

Prereq: compile C program

if [ -f "/tmp/t1040_linux_pcapdemo" ]; then exit 0; else exit 1; fi

Cleanup:

rm -f /tmp/t1040_linux_pcapdemo

Description: Captures packets with domain=AF_INET,type=SOCK_RAW,protocol=TCP for a few seconds.

Prereq: compile C program

if [ -f "/tmp/t1040_linux_pcapdemo" ]; then exit 0; else exit 1; fi

Cleanup:

rm -f /tmp/t1040_linux_pcapdemo

Description: Captures packets with domain=AF_INET,type=SOCK_PACKET,protocol=UDP for a few seconds. SOCK_PACKET is "obsolete" according to the man page, but still works on Ubuntu 20.04

Prereq: compile C program

if [ -f "/tmp/t1040_linux_pcapdemo" ]; then exit 0; else exit 1; fi

Cleanup:

rm -f /tmp/t1040_linux_pcapdemo

Description: Captures packets with domain=AF_PACKET,type=SOCK_RAW for a few seconds. Sets a BPF filter on the socket to filter for UDP traffic.

Prereq: compile C program

if [ -f "/tmp/t1040_linux_pcapdemo" ]; then exit 0; else exit 1; fi

Cleanup:

rm -f /tmp/t1040_linux_pcapdemo

Description: PowerShell Built-in Cmdlets to capture network traffic. https://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps

Cleanup:

del $ENV:Temp\sniff.etl

Description: Exfiltrates a file present on the victim machine to the C2 server.

Description: Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.

Description: Scan ports to check for listening ports. Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.

Description: Scan ports to check for listening ports with Nmap. Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.

Prereq: Check if nmap command exists on the machine

if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;

Prereq: Check if nc command exists on the machine

if [ -x "$(command -v nc)" ]; then exit 0; else exit 1; fi;

Prereq: Check if telnet command exists on the machine

if [ -x "$(command -v telnet)" ]; then exit 0; else exit 1; fi;

Description: Scan ports to check for listening ports for the local host 127.0.0.1

Prereq: NMap must be installed

if (cmd /c "nmap 2>nul") {exit 0} else {exit 1}

Description: Scan ports to check for listening ports with python

Prereq: Check if python exists on the machine

if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }

Description: Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn

Description: Search for MS17-10 vulnerable Windows Servers in the domain using powerSQL function of WinPwn

Description: Search for bluekeep vulnerable Windows Systems in the domain using bluekeep function of WinPwn. Can take many minutes to complete (~600 seconds in testing on a small domain).

Description: Search for potentially vulnerable web apps (low hanging fruits) using fruit function of WinPwn

Description: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.

Prereq: Verify docker is installed.

which docker

Prereq: Verify docker service is running.

sudo systemctl status docker --no-pager

Cleanup:

docker stop t1046_container
docker rmi -f t1046

Description: Scanning common ports in a /24 subnet. If no IP address for the target subnet is specified the test tries to determine the attacking machine's "primary" IPv4 address first and then scans that address with a /24 netmask. The connection attempts to use a timeout parameter in milliseconds to speed up the scan. Please note the atomic might not print any output until the scans are completed.

Description: Availability of remote desktop services can be checked using get- cmdlet of PowerShell

Description: Scan multiple ports to check for listening ports with nmap

Prereq: Check if nmap command exists on the machine

if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;

Description: An adversary might use WMI to list all local User Accounts. When the test completes , there should be local user accounts information displayed on the command line.

Description: An adversary might use WMI to list Processes running on the compromised host. When the test completes , there should be running processes listed on the command line.

Description: An adversary might use WMI to list installed Software hotfix and patches. When the test completes, there should be a list of installed patches and when they were installed.

Description: An adversary might use WMI to check if a certain Remote Service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Description: This test uses wmic.exe to execute a process on the local host. When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.

Cleanup:

wmic process where name='notepad.exe' delete >nul 2>&1

Description: This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter. To clean up, provide the same node input as the one provided to run the test A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable

Cleanup:

wmic /user:DOMAIN\Administrator /password:P@ssw0rd1 /node:"127.0.0.1" process where name='notepad.exe' delete >nul 2>&1

Description: Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand Powershell -nop -exec bypass -EncodedCommand Where the –EncodedCommand, once decoded, would resemble: Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name create -ArgumentList notepad.exe You should expect to see notepad.exe running after execution of this test. [Solarigate Analysis from Microsoft](https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/)

Description: This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic. [Cybereason blog post No Win32_ProcessNeeded](https://www.cybereason.com/blog/wmi-lateral-movement-win32)

Cleanup:

$CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Atomic"))
try { $CleanupClass.Delete() } catch {}

Description: This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.

Prereq: DLL with function to execute must exist on disk at specified location (..\ExternalPayloads\calc.dll)

if (Test-Path "..\ExternalPayloads\calc.dll") {exit 0} else {exit 1}

Cleanup:

taskkill /f /im calculator.exe

Description: Emulates uninstalling applications using WMIC. This method only works if the product was installed with an msi file. APTs have been seen using this to uninstall security products.

Prereq: TightVNC must be installed.

if ((Test-Path "C:\Program Files\TightVNC\tvnviewer.exe")-Or (Test-Path "C:\Program Files (x86)\TightVNC\tvnviewer.exe")) {exit 0} else {exit 1}

Cleanup:

msiexec /i "..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

Description: Exfiltrate data HTTPS using curl to file share site file.io

Prereq: Curl must be installed on system.

if (Test-Path C:\Windows\System32\Curl.exe) {exit 0} else {exit 1}

Prereq: T1048.002/src/artifact must be exist on system.

if (Test-Path "T1048.002/src/artifact") {exit 0} else {exit 1}

Description: Exfiltrate data HTTPS using curl to file share site file.io

Description: Exfiltrate data over HTTPS using wget --post-file method

Description: Exfiltrate data over HTTPS using wget --post-data method

Description: A firewall rule (ipfw,pf,iptables or firewalld) will be needed to allow exfiltration on port 1337. Upon successful execution, sh will be used to make a directory (/tmp/victim-staging-area), write a txt file, and host the directory with Python on port 1337, to be later downloaded.

Description: Exfiltration of specified file over ICMP protocol. Upon successful execution, powershell will utilize ping (icmp) to exfiltrate notepad.exe to a remote address (default 127.0.0.1). Results will be via stdout.

Description: Exfiltration of specified file over DNS protocol.

Description: Exfiltration of specified file over HTTP. Upon successful execution, powershell will invoke web request using POST method to exfiltrate notepad.exe to a remote address (default http://127.0.0.1). Results will be via stdout.

Description: Exfiltration of specified file over SMTP. Upon successful execution, powershell will send an email with attached file to exfiltrate to a remote address. Results will be via stdout.

Description: This test simulates MAZE's ransomware's ability to exfiltrate data via FTP. Upon successful execution, all 7z files within the %windir%\temp directory will be uploaded to a remote FTP server. Reference: https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents

Cleanup:

$ftp = "ftp://127.0.0.1/"
try {foreach ($file in (dir "$env:windir\temp" "*.7z"))
{$uri = New-Object System.Uri($ftp+$file.name)
$ftp_del = [System.Net.FtpWebRequest]::create($uri)
$ftp_del.Credentials = New-Object System.Net.NetworkCredential('None','None')
$ftp_del.Method = [System.Net.WebRequestMethods+Ftp]::DeleteFile
$ftp_del.GetResponse()}} catch{}

Description: Rclone may be used by an adversary to exfiltrate data to a publicly hosted FTP server. [Reference](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)

Prereq: Check if the exfil package exists

if (Test-Path C:\Users\Public\Downloads\exfil.zip) {exit 0} else {exit 1}

Prereq: Check if rclone zip exists

if (Test-Path C:\Users\Public\Downloads\rclone-current-windows-amd64.zip) {exit 0} else {exit 1}

Description: An adversary may use the python3 standard library module http.server to exfiltrate data. This test checks if python3 is available and if so, creates a HTTP server on port 9090, captures the PID, sleeps for 10 seconds, then kills the PID and unsets the $PID variable.

Description: Input a domain and test Exfiltration over SSH Remote to Local Upon successful execution, sh will spawn ssh contacting a remote domain (default: target.example.com) writing a tar.gz file.

Description: Input a domain and test Exfiltration over SSH Local to Remote Upon successful execution, tar will compress /Users/* directory and password protect the file modification of `Users.tar.gz.enc` as output.

Description: DNSExfiltrator enables the transfer (exfiltration) of a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel. !!! Test will fail without a domain under your control with A record and NS record !!! See this github page for more details - https://github.com/Arno0x/DNSExfiltrator

Prereq: DNSExfiltrator powershell file must exist on disk at specified location (..\ExternalPayloads\dnsexfil.ps1)

if (Test-Path "..\ExternalPayloads\dnsexfil.ps1") {exit 0} else {exit 1}

Description: This test demonstrates how an attacker can exfiltrate sensitive information by encoding it as a subdomain (using base64 encoding) and making DNS queries via the dig command to a controlled DNS server.

Prereq: dig command

which dig

Description: Get a listing of network connections. Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. Results will output via stdout.

Description: Get a listing of network connections. Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.

Description: Get a listing of network connections. Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.

Prereq: Check if netstat command exists on the machine

if [ -x "$(command -v netstat)" ]; then exit 0; else exit 1; fi;

Description: Get a listing of network connections, domains, domain users, and etc. sharpview.exe located in the bin folder, an opensource red-team tool. Upon successful execution, cmd.exe will execute sharpview.exe . Results will output via stdout.

Prereq: Sharpview.exe must exist on disk at specified location (..\ExternalPayloads\SharpView.exe)

if (Test-Path "..\ExternalPayloads\SharpView.exe") {exit 0} else {exit 1}

Description: Executes cmd.exe Note: deprecated in Windows 8+ Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.

Description: This test submits a command to be run in the future by the `at` daemon.

Prereq: The `at` and `atd` executables must exist in the PATH

if [ "$(uname)" = 'FreeBSD' ]; then which at; else which at && which atd; fi;

Prereq: The `atd` daemon must be running

if [ $(uname) = 'Linux' ]; then systemctl status atd || service atd status; fi;

Description: Launches a short-lived Ubuntu pod, installs the `at` utility, starts the `atd` daemon, and submits a job with `at`. The pod is deleted after execution.

Prereq: kubectl must be installed and configured

which kubectl

Description: This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.

Cleanup:

crontab /tmp/notevil

Description: This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

Cleanup:

rm /etc/cron.daily/persistevil -f
rm /etc/cron.hourly/persistevil -f
rm /etc/cron.monthly/persistevil -f
rm /etc/cron.weekly/persistevil -f

Description: This test adds a script to /etc/cron.d folder configured to execute on a schedule.

Cleanup:

rm /etc/cron.d/persistevil -f

Description: This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

Cleanup:

rm /var/spool/cron/crontabs/persistevil -f

Description: Run an exe on user logon or system startup. Upon execution, success messages will be displayed for the two scheduled tasks. To view the tasks, open the Task Scheduler and look in the Active Tasks pane.

Cleanup:

schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1

Description: Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.

Cleanup:

SCHTASKS /Delete /TN spawn /F >nul 2>&1

Description: Create a task on a remote system. Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.

Cleanup:

SCHTASKS /Delete /S localhost /U DOMAIN\user /P At0micStrong /TN "Atomic task" /F >nul 2>&1

Description: Create an atomic scheduled task that leverages native powershell cmdlets. Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.

Cleanup:

Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1

Description: This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within 30 - 40 seconds after this module has run

Prereq: Microsoft Word must be installed

try {
New-Object -COMObject "Word.Application" | Out-Null
$process = "Word"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }

Cleanup:

Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false

Description: Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.

Prereq: File to copy must exist on disk at specified location (T1053.005\src\T1053_005_WMI.xml)

if (Test-Path "T1053.005\src\T1053_005_WMI.xml") {exit 0} else {exit 1}

Cleanup:

Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1

Description: A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created. The scheduled task will launch powershell to decode and run the command in the registry daily. This is a persistence mechanism recently seen in use by Qakbot. [Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)

Cleanup:

schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1

Description: Create an scheduled task that executes calc.exe after user login from XML that contains hidden setting attribute. This technique was seen several times in tricbot malware and also with the targetted attack campaigne the industroyer2.

Prereq: File to copy must exist on disk at specified location (T1053.005\src\T1053_05_SCTASK_HIDDEN_ATTRIB.xml)

if (Test-Path "T1053.005\src\T1053_05_SCTASK_HIDDEN_ATTRIB.xml") {exit 0} else {exit 1}

Cleanup:

Unregister-ScheduledTask -TaskName "atomic red team" -confirm:$false >$null 2>&1

Description: Create a scheduled task with an action and modify the action to do something else. The initial idea is to showcase Microsoft Windows TaskScheduler Operational log modification of an action on a Task already registered. It will first be created to spawn cmd.exe, but modified to run notepad.exe. Upon successful execution, powershell.exe will create a scheduled task and modify the action.

Cleanup:

Unregister-ScheduledTask -TaskName "AtomicTaskModifed" -confirm:$false >$null 2>&1

Description: Create a scheduled task through manipulation of registry keys. This procedure is implemented using the [GhostTask](https://github.com/netero1010/GhostTask) utility. By manipulating registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree, the tool creates user-specified scheduled tasks without a corresponding Windows Event 4698, which is logged when scheduled tasks are created through conventional means. This requires a download of the GhostTask binary, which must be run as NT Authority\SYSTEM. Upon successful execution of this test, a scheduled task will be set to run at logon which launches notepad.exe or runs a user-specified command. For further exploration of this procedure and guidance for hunting and detection, see [Hunting G-G-G-GhostTasks!](https://medium.com/p/154b50ab6a78).

Prereq: PsExec tool from Sysinternals must exist in the ExternalPayloads directory

if (Test-Path "..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

Prereq: GhostTask.exe tool from netero101 must exist in the ExternalPayloads directory. This tool may be quarantined by windows defender; disable windows defender real-time protection to fix it or add the ExternalPayloads directory as an exclusion, using a command like `Add-MpPreference -ExclusionPath "PathToAtomicsFolder\..\ExternalPayloads\"`

if (Test-Path "..\ExternalPayloads\GhostTask.exe") { exit 0} else { exit 1}

Cleanup:

"..\ExternalPayloads\PsExec.exe" \\localhost -accepteula -s "cmd.exe"
"..\ExternalPayloads\GhostTask.exe" \\localhost delete lilghostie > nul

Description: Adds persistence by abusing `compmgmt.msc` via a scheduled task. When the Computer Management console is opened, it will run a malicious payload (in this case, `calc.exe`). This technique abuses scheduled tasks and registry modifications to hijack legitimate system processes.

Cleanup:

reg delete "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /f
schtasks /Delete /TN "CompMgmtBypass" /F

Description: Adds persistence by abusing `eventviewer.msc` via a scheduled task. When the eventviewer console is opened, it will run a malicious payload (in this case, `calc.exe`).

Cleanup:

reg delete "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /f
schtasks /Delete /TN "EventViewerBypass" /F

Description: This test creates Systemd service and timer then starts and enables the Systemd timer

Cleanup:

systemctl stop art-timer.timer
systemctl disable art-timer.timer
rm /etc/systemd/system/art-timer.service
rm /etc/systemd/system/art-timer.timer
systemctl daemon-reload

Description: Schedule a user level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.

Prereq: Check if systemd-run exists on the machine

if [ -x "$(command -v systemd-run)" ]; then exit 0; else exit 1; fi;

Cleanup:

systemctl --user stop Atomic-Red-Team.service
systemctl --user stop Atomic-Red-Team.timer
rm /tmp/log

Description: Schedule a system level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.

Prereq: Check if systemd-run exists on the machine

if [ -x "$(command -v systemd-run)" ]; then exit 0; else exit 1; fi;

Cleanup:

systemctl stop Atomic-Red-Team.service
systemctl stop Atomic-Red-Team.timer
rm /tmp/log

Description: Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Prereq: kubectl must be installed

which kubectl

Description: Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Prereq: kubectl must be installed

which kubectl

Cleanup:

kubectl delete cronjob art -n default

Description: Windows 10 Utility To Inject DLLS. Upon successful execution, powershell.exe will download T1055.dll to disk. Powershell will then spawn mavinject.exe to perform process injection in T1055.dll. With default arguments, expect to see a MessageBox, with notepad's icon in taskbar.

Prereq: Utility to inject must exist on disk at specified location (T1055.001\src\x64\T1055.001.dll)

if (Test-Path "T1055.001\src\x64\T1055.001.dll") {exit 0} else {exit 1}

Description: Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique via function of WinPwn

Description: This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.

Prereq: Portable Executable to inject must exist at specified location (T1055.002\bin\RedInjection.exe)

if (Test-Path "T1055.002\bin\RedInjection.exe") {exit 0} else {exit 1}

Cleanup:

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Description: This test injects a MessageBox shellcode generated by msfvenom in Notepad.exe using Thread Execution Hijacking. When successful, a message box will appear with the "Atomic Red Team" caption after one or two seconds.

Description: Process Injection using C# reference: https://github.com/pwndizzle/c-sharp-memory-injection Excercises Five Techniques 1. Process injection 2. ApcInjectionAnyProcess 3. ApcInjectionNewProcess 4. IatInjection 5. ThreadHijack Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.

Prereq: T1055.004\bin\T1055.exe must be exist on system.

if (Test-Path "T1055.004\bin\T1055.exe") {exit 0} else {exit 1}

Description: Creates a process in a suspended state and calls QueueUserAPC WinAPI to add a UserAPC to the child process that points to allocated shellcode. ResumeThread is called which then calls NtTestAlert to execute the created UserAPC which then executes the shellcode. This technique allows for the early execution of shellcode and potentially before AV/EDR can hook functions to support detection. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe) - References: - https://www.bleepingcomputer.com/news/security/early-bird-code-injection-technique-helps-malware-stay-undetected/ - https://www.ired.team/offensive-security/code-injection-process-injection/early-bird-apc-queue-code-injection

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "werfault" -ErrorAction SilentlyContinue

Description: Uses the undocumented NtQueueAPCThreadEx WinAPI to create a "Special User APC" in the current thread of the current process to execute shellcode. Since the shellcode is loaded and executed in the current process it is considered local shellcode execution. Steps taken with this technique 1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write 2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space 3. Change the memory page permissions to Execute/Read with VirtualProtect 4. Get a handle to the current thread 5. Execute the shellcode in the current thread by creating a Special User APC through the NtQueueApcThreadEx function - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#rtlcreateuserthread) - References: - https://repnz.github.io/posts/apc/user-apc/ - https://docs.rs/ntapi/0.3.1/ntapi/ntpsapi/fn.NtQueueApcThreadEx.html - https://0x00sec.org/t/process-injection-apc-injection/24608 - https://twitter.com/aionescu/status/992264290924032005 - http://www.opening-windows.com/techart_windows_vista_apc_internals2.htm#_Toc229652505

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue

Description: Hooks functions of main process to inject a payload via Extra Window Memory (EWM) injection technique

Prereq: T1055.011x64.exe and payload must exist on disk at specified location (T1055.011\bin\T1055.011_#{arch}.exe and T1055.011\bin\payload.exe_#{arch}.bin)

if (Test-Path T1055.011\bin\T1055.011_#{arch}.exe) {exit 0} else {exit 1}

Cleanup:

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Description: This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent. Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)

Prereq: Start-Hollow.ps1 must be installed

if (Test-Path "T1055.012\src\Start-Hollow.ps1") {exit 0} else {exit 1}

Cleanup:

Stop-Process -Name "notepad" -ErrorAction Ignore

Description: This module executes notepad.exe from within the WINWORD.EXE process

Prereq: Microsoft Word must be installed

try {
New-Object -COMObject "Word.Application" | Out-Null
$process = "Word"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }

Description: Creates a process in a suspended state, executes shellcode to spawn calc.exe in a child process, and then resumes the original process. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocess)

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "werfault" -ErrorAction SilentlyContinue

Description: Create a process in a suspended state, execute shellcode to spawn calc.exe in a child process, and then resume the original process. This test uses the CreatePipe function to create an anonymous pipe that parent and child processes can communicate over. This anonymous pipe allows for the retrieval of output generated from executed shellcode. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "werfault" -ErrorAction SilentlyContinue

Description: This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds. Notepad will open following the appearance of the message box.

Prereq: Injector ListPlanting.exe must exist at specified location (T1055.015\bin\ListPlanting.exe)

if (Test-Path "T1055.015\bin\ListPlanting.exe") {exit 0} else {exit 1}

Cleanup:

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Description: This module injects shellcode into a newly created process and executes. By default the shellcode is created, with Metasploit, for use on x86-64 Windows 10 machines. Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office is required.

Prereq: The 64-bit version of Microsoft Office must be installed

try {
$wdApp = New-Object -COMObject "Word.Application"
$path = $wdApp.Path
Stop-Process -Name "winword"
if ($path.contains("(x86)")) { exit 1 } else { exit 0 }
} catch { exit 1 }

Prereq: "T1055\src\x64\T1055-macrocode.txt" must exist on disk at specified location

if (Test-Path "T1055\src\x64\T1055-macrocode.txt") {exit 0} else {exit 1}

Description: Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread). Especially useful against domain controllers in Active Directory environments. It must be executed in the context of a user who is privileged on remote `machine`. The effect of `/inject` is explained in

Prereq: Mimikatz executor must exist on disk and at specified location (%tmp%\mimikatz\x64\mimikatz.exe)

$mimikatz_path = cmd /c echo %tmp%\mimikatz\x64\mimikatz.exe
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}

Prereq: PsExec tool from Sysinternals must exist on disk at specified location (..\ExternalPayloads\PsExec.exe)

if (Test-Path "..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

Description: This test creates a section object in the local process followed by a local section view. The shellcode is copied into the local section view and a remote section view is created in the target process, pointing to the local section view. A thread is then created in the target process, using the remote section view as start address.

Cleanup:

Stop-Process $notepad.pid

Description: This test used the Windows undocumented remote-fork API RtlCreateProcessReflection to create a cloned process of the parent process with shellcode written in its memory. The shellcode is executed after being forked to the child process. The technique was first presented at BlackHat Europe 2022. Shellcode will open a messsage box and a notepad.

Cleanup:

Get-Process -Name calc, CalculatorApp -ErrorAction SilentlyContinue | Stop-Process -Force

Description: This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode. The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms that relied on API call sequences and heuristics. The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread. The injected shellcode will open a message box and a notepad. RWX Process Injection, also known as MockingJay, was introduced to the security community by SecurityJoes. More details can be found at https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution. The original injector and idea were developed for game cheats, as visible at https://github.com/M-r-J-o-h-n/SWH-Injector.

Prereq: Utility to inject must exist on disk at specified location (T1055\bin\x64\vuln_dll\msys-2.0.dll)

if (Test-Path "T1055\bin\x64\vuln_dll\msys-2.0.dll") {exit 0} else {exit 1}

Cleanup:

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Description: Uses WinAPI UuidFromStringA to load shellcode to a memory address then executes the shellcode using EnumSystemLocalesA. With this technique, memory is allocated on the heap and does not use commonly suspicious APIs such as VirtualAlloc, WriteProcessMemory, or CreateThread - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#uuidfromstringa) - References: - https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/ - https://twitter.com/_CPResearch_/status/1352310521752662018 - https://blog.securehat.co.uk/process-injection/shellcode-execution-via-enumsystemlocala

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue

Description: Uses EtwpCreateEtwThread function from ntdll.dll to execute shellcode within the application's process. This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly. Steps taken with this technique 1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write 2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space 3. Change the memory page permissions to Execute/Read with VirtualProtect 4. Call EtwpCreateEtwThread on shellcode address 5. Call WaitForSingleObject so the program does not end before the shellcode is executed - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#EtwpCreateEtwThread) - References: - https://gist.github.com/TheWover/b2b2e427d3a81659942f4e8b9a978dc3 - https://www.geoffchappell.com/studies/windows/win32/ntdll/api/etw/index.htm

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue

Description: Executes shellcode in a remote process. Steps taken with this technique 1. Get a handle to the target process 2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write 3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process 4. Change the memory page permissions to Execute/Read with VirtualProtectEx 5. Execute the entrypoint of the shellcode in the remote process with RtlCreateUserThread 6. Close the handle to the remote process - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#rtlcreateuserthread) - References: - https://www.cobaltstrike.com/blog/cobalt-strikes-process-injection-the-details-cobalt-strike

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name werfault -ErrorAction SilentlyContinue

Description: Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process. This application leverages functions from the golang.org/x/sys/windows package, where feasible, like the windows.OpenProcess(). Steps taken with this technique 1. Get a handle to the target process 2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write 3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process 4. Change the memory page permissions to Execute/Read with VirtualProtectEx 5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread 6. Close the handle to the remote process - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethread) - References: - https://www.ired.team/offensive-security/code-injection-process-injection/process-injection

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name werfault -ErrorAction SilentlyContinue

Description: Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellcode in a remote process. This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly. 1. Get a handle to the target process 2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write 3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process 4. Change the memory page permissions to Execute/Read with VirtualProtectEx 5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread 6. Close the handle to the remote process - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethreadnative)

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name werfault -ErrorAction SilentlyContinue

Description: This program executes shellcode in the current process using the following steps 1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write 2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space 3. Change the memory page permissions to Execute/Read with VirtualProtect 4. Call CreateThread on shellcode address 5. Call WaitForSingleObject so the program does not end before the shellcode is executed This program leverages the functions from golang.org/x/sys/windows to call Windows procedures instead of manually loading them - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthread)

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue

Description: This program executes shellcode in the current process using the following steps 1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write 2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space 3. Change the memory page permissions to Execute/Read with VirtualProtect 4. Call CreateThread on shellcode address 5. Call WaitForSingleObject so the program does not end before the shellcode is executed This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthreadnative)

Cleanup:

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue

Description: The UUIDs Process Injection code was first introduced by the NCC Group. The code can be stored in UUID forms on the heap and converted back to binary via UuidFromStringA at runtime. In this new custom version of UUID injection, EnumSystemLocalesA is the only API called to execute the code. We used custom UuidToString and UuidFromString implementations to avoid using UuidFromStringA and RPCRT4.dll, thereby eliminating the static signatures. This technique also avoided the use of VirtualAlloc, WriteProcessMemory and CreateThread The injected shellcode will open a message box and a notepad. Reference to NCC Group: https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/ Concept from: http://ropgadget.com/posts/abusing_win_functions.html

Prereq: Portable Executable to inject must exist at specified location (T1055\bin\x64\uuid_injection.exe)

if (Test-Path "T1055\bin\x64\uuid_injection.exe") {exit 0} else {exit 1}

Cleanup:

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Description: Utilize PowerShell and external resource to capture keystrokes [Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1) Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1) Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.

Prereq: Get-Keystrokes PowerShell script must exist on disk at PathToAtomicsFolder\T1056.001\src\Get-Keystrokes.ps1

if (Test-Path "T1056.001\src\Get-Keystrokes.ps1") {exit 0} else {exit 1}

Cleanup:

Remove-Item $env:TEMP\key.log -ErrorAction Ignore

Description: Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log. All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges. Passwords hidden by the console can also be logged, with 'log_passwd' as in this example. If root logging is enabled, then output from any process which is later started by root is also logged, even if this policy is carefully enabled (e.g. 'disable=*' as the initial command). Use 'aureport --tty' or other audit.d reading tools to read the log output, which is binary. Mac OS does not currently contain the pam_tty_audit.so library.

Prereq: Checking if pam_tty_audit.so is installed

test -f '/usr/lib/pam/pam_tty_audit.so -o /usr/lib64/security/pam_tty_audit.so'

Cleanup:

sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth
sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth

Description: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog. To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/

Prereq: This test requires to be run in a bash shell and that logger and tee are installed.

if [ "$(echo $SHELL)" != "/bin/bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi
if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi
if [ ! -x "$(command -v tee)" ]; then echo -e "\n***** tee NOT installed *****\n"; exit 1; fi

Cleanup:

unset PROMPT_COMMAND

Description: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog. To gain persistence the command could be added to the users .shrc or .profile

Prereq: This test requires to be run in a bash shell and that logger and tee are installed.

if [ "$(echo $SHELL)" != "/bin/sh" ]; then echo -e "\n***** sh not running! *****\n"; exit 1; fi
if [ ! -x "$(command -v logger)" ]; then echo -e "\n***** logger NOT installed *****\n"; exit 1; fi

Cleanup:

unset PS2

Description: When a command is executed in bash, the BASH_COMMAND variable contains that command. For example :~$ echo $BASH_COMMAND = "echo $BASH_COMMAND". The trap command is not a external command, but a built-in function of bash and can be used in a script to run a bash function when some event occurs. trap will detect when the BASH_COMMAND variable value changes and then pipe that value into a file, creating a bash session based keylogger. To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/

Prereq: This test requires to be run in a bash shell

if [ "$(echo $0)" != "bash" ]; then echo -e "\n***** Bash not running! *****\n"; exit 1; fi

Cleanup:

rm /tmp/.keyboard.log

Description: Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. The Linux audit tool auditd can use the pam_tty_audit module to enable auditing of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes.

Prereq: This test requires sshd and auditd

if [ ! -x "$(command -v sshd)" ]; then echo -e "\n***** sshd NOT installed *****\n"; exit 1; fi
if [ ! -x "$(command -v auditd)" ]; then echo -e "\n***** auditd NOT installed *****\n"; exit 1; fi

Cleanup:

cp -fv /tmp/sshd /etc/pam.d/